License plate recognition technology developed for law enforcement and embraced by the auto repossession industry is being opened to wider use through a Florida company that lets its clients track the travels of millions of private vehicles—adding to privacy advocates' concerns that such data could be used improperly.
TLO, an investigative technology company in Boca Raton, Fla., began offering the search service to its private industry clients in late June, saying it taps into a database of more than 1 billion records collected by automatic license plate readers.
A report earlier this week by the ACLU found that U.S. law enforcement agencies are scooping up droves of data using license plate readers, creating massive databases where more than 99 percent of the entries represent innocent people.
But private industry also has put the technology to work, most prominently in recovering vehicles from deadbeat borrowers. As the new TLO service demonstrates, private use of LPR data for other purposes is expanding rapidly.
It's unclear who runs the database that TLO taps into, but the two leading companies in the field say that each month their databases collect tens of millions of pieces of geo-located information from thousands of license plate readers, mounted on tow trucks, mall security vehicles, police cars, at the entrances to store parking lots, on toll booths or along city streets and highways.
The data can include the location of the vehicle, the date and time it was spotted, and an image. Sometimes, drivers and passengers appear in the images.
"The prospect of a private company making such data public to all comers is scary," said Catherine Crump, an attorney with the ACLU's Speech, Privacy and Technology Project. "This kind of information is particularly what stalkers would love to get their hands on."
Crump, who wrote the ACLU report but said she had not been aware of TLO's service, worried about privacy concerns with other possible uses, such as corporations tracking where their employees go after work, politicians scouting rivals or people keeping tabs on babysitters' travels.
But those involved in amassing license plate databases say such fears are unfounded—and that data obtained via Facebook, Twitter or a person's cellphone are far more intrusive.
"They can figure out who you date," said Scott A. Jackson, founder and CEO of Illinois-based MVTRAC, which controls one of the two big private LPR databases in the U.S. "For us to figure out that information, it would take us billions and billions of license plates to get to that point. We're at least 10 years away from that."
Jackson also said companies that use MVTRAC's camera systems and tap into its database go through rigorous background checks and vetting of computer security and personnel. He said that anyone who used MVTRAC's database improperly could be violating three federal privacy laws.
Still, he said, the impetus is on companies like his to show that they use data properly.
"There's no illegality whatsoever for me giving you data about a license plate. But as big data becomes exponential, society has a reasonable expectation that companies will handle themselves responsibly," Jackson said. "I wouldn't give this data to someone I don't know—they might be a stalker."
Similarly, Chris Metaxas, chief executive officer of Texas-based Digital Recognition Network, or DRN, which holds the other big private LPR database, said strict rules govern how such data is collected and used. He said that the ACLU's concerns about how long LPR data is kept by law enforcement miss the point.
"The issue is really not about retention of data. The real issue is one of access control and effective policies" surrounding privacy and security, Metaxas said.
Metaxas said his company adheres to best practices laid out in federal driver's privacy laws for access control, encryption and security of its data. DRN's data does not contain private information about individuals, he said.
"We do not retain any identifiable information related to owners of those license plates," he said.
More from NBC News:
Ex-Pentagon official has 'heavy heart' over US teen's drone strike death
Former CIA agent wanted in Italy 'rendition' case detained in Panama
Siblings with same life-threatening disease get split decision from insurer
Jackson said that MVTRAC has expanded the use of its data beyond law enforcement and the repossession and insurance industries but that his company did not contract with TLO or have plans for a service like TLO's.
When asked whether TLO used DRN's database, Metaxas said he could not answer questions about possible clients.
A source at TLO with knowledge about how the company markets such information said that not just anyone can get access to the Vehicle Sightings database. Clients must be part of specific industries, follow rules on permissible use of TLO's databases and describe specifically how they wanted to use the data, the source said.
TLO advertises on its website that it serves clients in the legal, financial services, corporate risk and private investigative industries, along with investigative journalists and law enforcement and government agencies.
The source, who spoke on condition of anonymity, said that the Vehicle Sightings tool is not available to the banking and car repossession industries, but not because of privacy concerns: Those industries are bread and butter for the company that actually owns the database, the source said.
TLO says on its website that the service offers photos of the vehicle and license plate along with time and geographic stamps, and can map where vehicles were seen.