Note
Read the responsibility note on the section index before using anything here.
Most countries have plate readers and no Flock. The vendor, the operator, and the law will be different, but the research method is portable, because every deployment has to answer the same handful of questions somewhere in writing.
Five questions that produce a picture
- Who operates them? National police, a regional force, a municipality, a road or toll authority, or a private operator such as a car park or retail chain that shares data with police. The answer determines which access law applies and which regulator has jurisdiction.
- What is the legal basis? Every democratic system requires the operator to be able to point at something: a statute, a regulation, a police order, or an impact assessment. Asking for the document is a neutral question with a revealing answer.
- How long is data kept? Retention is where proportionality arguments are won and lost, and it is usually a specific number that somebody wrote down.
- Who can search it, and is the search recorded? If there is no audit trail at all, that is more significant than any individual misuse, and it is worth establishing early.
- Who else gets the data? Other forces, other agencies, other countries, private partners. Sharing arrangements are where systems built for one purpose end up serving another.
The European Union and EEA
Police use of plate readers falls under the Law Enforcement Directive (2016/680) rather than the GDPR, implemented through national law, while private operators fall under the GDPR. In practice that gives you several levers:
- A data protection impact assessment is normally required before deployment, and asking for it is often more productive than a general access request.
- You have a right of access to personal data about you, with law enforcement exemptions that vary by member state.
- Every country has a supervisory authority that takes complaints and can investigate. The European Data Protection Board publishes the current list.
- National access-to-information law applies to the procurement documents, contracts, and policies, separately from data protection law.
Elsewhere
The pattern generalises. Find the national data protection authority, privacy commissioner, or ombudsman, and find the access-to-information statute. In Australia the Office of the Australian Information Commissioner sits alongside state-level regulators and state access laws. In New Zealand the Office of the Privacy Commissioner performs a similar role. Many countries have a constitutional or statutory access right that is rarely exercised against police technology, which is usually a sign that it will work rather than a sign that it will not.
Mapping works anywhere
The OpenStreetMap tagging scheme for surveillance equipment is international.
Cameras tagged in OpenStreetMap with
man_made=surveillance and surveillance:type=ALPR appear in
DeFlock and the other maps built on that data, regardless
of country. If your country has no mapping project, contributing to
OpenStreetMap directly means one does not need to exist.
Two cautions
Photographing police or state infrastructure is not equally safe everywhere. There are countries where it will get you detained, and countries where it is lawful but will still get you stopped and questioned. Know which one you are in before you start, and do not assume that a project written for American streets transfers to yours.
Be careful about assuming a system is benign because it is undocumented. The absence of reporting on plate readers in a country is more often a gap in scrutiny than evidence that nothing is deployed. That gap is exactly what makes the first person to file a records request useful.
If you research your own country and find something worth writing down, this section is designed to grow by country, and a new page is a contribution rather than a change to the site.