A new California appellate decision may help limit private litigation under California's Automated License Plate Recognition (ALPR) statute. In Mata v. Digital Recognition Network, Inc., California’s Fourth Appellate District affirmed the defendant’s summary judgment, holding that a plaintiff must demonstrate actual harm resulting from an alleged ALPR violation to have standing to sue. Generalized privacy concerns, subjective feelings of surveillance, or allegations of statutory noncompliance alone are not enough.

The decision provides an important counterweight to the recent wave of ALPR litigation and may offer businesses a standing defense where plaintiffs cannot identify a concrete injury arising from the alleged violation.

What Happened In Mata?

In Mata, the plaintiff acknowledged that Digital Recognition Network (DRN) maintained a written privacy usage policy on its website but claimed that it did so only to appear in compliance with the ALPR statute and that DRN had no actual intent of complying with privacy laws. The trial court granted summary judgment in DRN’s favor because the plaintiff failed to offer evidence of actual harm as required to sue under the ALPR statute. The Court of Appeal agreed, concluding that a person's belief that his privacy has been invaded does not constitute actionable harm under the statute absent a concrete injury resulting from the alleged violation.

How Did The Court Rein In ALPR Claims?

The Court of Appeal reiterated what federal courts had previously held—namely, that actual harm is required:

• A statutory violation alone is not enough. The court emphasized that the statute distinguishes between a “violation” and the “harm” caused by that violation, requiring plaintiffs to establish both.
• Subjective privacy concerns alone do not create actionable harm. The court rejected the argument that the collection and storage of ALPR data, coupled with a subjective belief that one’s privacy has been invaded, constitutes actionable harm.
• Concrete harm remains the touchstone. The court pointed to unauthorized access, unauthorized use, and security breaches as examples of the type of concrete harm contemplated by the statute.

Did The Court Retreat From Bartholomew?

While the court did not (and could not) overrule California’s First Appellate District opinion in Bartholomew v. Parking Concepts, Inc., it raised questions about several aspects of that decision:

• The court expressed skepticism toward Bartholomew's “right to know” theory. Bartholomew suggested that a plaintiff could be harmed by being deprived of information about how ALPR data is collected, used and maintained. Unlike Bartholomew, Mata repeatedly emphasized the need for actual harm resulting from the alleged statutory violation.
• The court focused on concrete harm. Throughout the opinion, the court returned to the statutory requirement that a plaintiff be “harmed by a violation,” indicating that generalized privacy concerns or policy-based theories of injury may not be sufficient absent a concrete injury resulting from the alleged violation.
• The court declined to expand standing based on alleged policy deficiencies alone. In doing so, it signaled a narrower approach to standing than the one advanced by plaintiffs in recent ALPR litigation.

Why Does This Matter For Businesses?

• The decision strengthens standing defenses. Businesses facing ALPR claims now have stronger arguments for dismissal or summary judgment where plaintiffs cannot identify unauthorized access, unauthorized disclosure, data misuse, a security incident, or another concrete injury.
• Compliance still matters. Mata does not eliminate the ALPR statute’s compliance obligations. Businesses that use ALPR technology should continue to review their usage and privacy policies, security practices, access controls, and vendor relationships to ensure compliance with the statute.
• Plaintiffs may face a higher hurdle. Plaintiffs will likely need to demonstrate a connection between the alleged statutory violation and a real-world injury, rather than relying on abstract privacy concerns or assertions that an ALPR operator failed to satisfy the statute’s technical requirements.
• The relationship between Mata and Bartholomew remains unsettled. Future litigation will likely focus on whether policy-related violations, standing alone, can satisfy the statute's harm requirement after Mata’s emphasis on concrete injury.

Bottom Line

Mata marks a significant development in California ALPR litigation. By requiring plaintiffs to demonstrate actual harm resulting from an alleged statutory violation, the court placed meaningful limits on claims based solely on generalized privacy concerns or alleged noncompliance with the ALPR statute. While the decision leaves unresolved questions regarding the scope of actionable harm and the continued reach of Bartholomew, it provides businesses with stronger grounds to challenge ALPR claims.