Bartholomew v. Parking Concepts - Modified Opinion and Denied Rehearing

1 Filed 2/27/26 (unmo dified opn. attached) CERTIFIED FOR PARTIAL PUB LICATION * IN THE COURT OF APPEAL OF THE STATE OF CALIFO RNIA FIRST APPELLAT E DISTRICT DIVISION FIVE BRENDAN P. BAR THOLOMEW, Plaintiff and A ppellant, v. PARKING CONCE PTS, INC., Defendant and Resp ondent. A171546 (San Francisco City & County Super. Ct. No. C GC- 24 -61262 4) ORDER MODIFYIN G OPINION AND DENYING RE HEARING NO CHANGE IN JU DGMENT THE COURT: It is ordered that the opinion filed herein on Feb ruary 5, 2026, be modified as follows: 1. On page 12, at the e nd of the senten ce, “Collecting and maintaining individuals’ ALPR i nformation wit hout implementing and making public the statutoril y required policy ha rms these individua ls by violating this right t o know,” add as footnote 10 the fol lowing footnote, which will require r enumbering of all subseque nt footnotes: 10 We express no opinion as to whether c ollecting and maintaining ALPR i nformation with a u sage and privacy pol icy * Pursuant to California Rule s of Court, rules 8.1 105(b) and 8.1110, this opinion is certified f or publication with the exception of parts II and I II.

2 that does not includ e every compon ent identified in sec tion 1798.90.51, subdi vision (b)(2) would also cause such har m. * * * There is no change i n the judgment. Respondent ’s petitio n for rehearing i s denied. SIMONS, Acting P. J. We concur. BURNS, J. CHOU, J. (A171546)

3 Brendan P. Barth olemew v. Parkin g Concepts, Inc. (A171546) Trial Court: Superior Court of C alifornia, City and County of San Francisco Trial Judge: Hon. Ethan P. Schulman Counsel: B ursor & Fisher, L. Timothy Fisher, Julia K. Venditti and Philip L. Fraie tta for Plaintif f and Appellant. Gordon Rees Sc ully Mansukhani, C raig J. Mariam, Michael J. Dailey and Katiuska Pimentel Vargas for Defe ndant and Respondent.

1 Filed 2/5/26 (unmo dified version) CERTIFIED FOR PARTIAL PUB LICATION * IN THE COURT OF APPEAL OF THE STATE OF CALIFO RNIA FIRST APPELLAT E DISTRICT DIVISION FIVE BRENDAN P. BAR THOLOMEW, Plaintiff and A ppellant, v. PARKING CONCE PTS, INC., Defendant and Resp ondent. A171546 (San Francisco City & County Super. Ct. No. C GC- 24 -61262 4) Brendan P. Barthol omew (Plaintiff) sue d Parking Concepts, Inc. (Parking Concepts), alleging that it automatically colle cted his licens e plate information when h e parked his ve hicle in its parking garage. Plaintiff claimed Parking Co ncepts violated a statutory scheme governing automa ted license plate rec ognition systems (C iv. Code, §§ 1 798.90.5 – 1 798.90.55 1; hereafter ALPR La w), by failing t o implement and m ake publicly available a policy governing the collection and use of this data. 2 * Pursuant to California Rule s of Court, rules 8.1 105(b) and 8.1110, this opinion is certified f or publication with the exception of parts II and I II. 1 All undesignated statutory r eferences are to the Civil Code. 2 Plaintiff also alleged claims under the u nfair competition l aw (Bus. & Prof. Code, § 17200 et seq.; hereafter U CL), and the Califor nia Constitution’s right to privacy (Cal. Const., art. I, § 1), which we address in the unpublished portion of this opini on.

2 The trial court sust ained Parking Conc epts’ demurrer without leav e to amend, in part on t he ground that Plai ntiff failed to allege harm within the meaning of the ALP R Law. We hol d that the collect ion and use of lice nse plate information, w ithout implem enting the statutoril y required poli cy governing this collec tion and use, co nstitutes such harm. BACKGROUND Plaintiff parke d his vehicle in a par king garage owned and/or operated by Parking Concept s (the Garage) “multiple times” in 2022 and 20 23. 3 When Plaintiff and o ther customers arrived at the Garage, they “pr ess [ed] a button on a kiosk ” and took a printed “ par king ticket. ” The pr inted ticket di splayed, among other inform ation, the “lice nse plate number” of the vehicle, al ong with the date and ti me of entry into the Garage. When leaving the Garage, customers paid at “a pay station” and th en drove to the exit, where a kiosk was located in front of a barrier ar m. A screen on the kiosk displaye d the vehicle’s license plat e number and “ the barrier arm woul d automatically lif t ” to allow the vehicle to exit. Plaintiff sued o n behalf of hi mself and others sim ilarly situa ted, alleging claim s for violations of the ALPR Law, the UC L, and the Californi a Constitution’s right to privac y. The tria l court su staine d Parking Concepts’ demurrer without le ave to amend and is sued judgment for P arking Concepts. DISCUSSION “ ‘ “ ‘ “ On appeal fro m a dismissal after an order sustaining a demurrer, we review the order de novo, exercisi ng our indep endent jud gment about 3 “ ‘ “ ‘ “ ‘We treat the demurrer as admitt ing all material fact s properly pleaded, but not con tentions, deductions or conclusions of fa ct or law.’ ” ’ ” ’ ” (Vann v. City a nd County of San Fr ancisco (2023) 97 Cal.A pp.5th 1013, 1 019 (Vann).)

3 whether the co mplaint states a ca use of action as a m atter of law.” ’ ” ’ ” (Vann, supra, 97 Ca l.App.5th at p. 1019.) “ ‘Alth ough our review is d e novo, it is plaintiffs’ burde n to affirmativ ely demonstrate tha t the demurrer was erroneously sustain ed as a matter of la w . . ..’ ” (Id. a t p. 1020.) “[W]hen a complaint ‘ is sustai ned without leave to amend, we decide whether there is a reasonable possibili ty that the defect ca n be cured by amen dment: if it can be, the trial court has a bused its discre tion and we r everse; if n ot, there has been no abuse of discretio n and we affirm. ’ [Citation.] ‘ “ [T] he burden is on the plaintiff to demonst rate that the trial co urt abused its discre tion. [Citation s.] Plaintiff must show in what manne r he can ame nd his comp laint and how that amendment wil l change the legal ef fect of his pleading. ” ’ ” (Ibid.) I. ALPR Law A. Legal Background T he ALPR Law, ena cted in 2015, govern s the operation and use of an “ ‘ [a] utomated licens e plate recognition s ystem’ or ‘ALPR sys tem,’ ” which is defined as “a search able computerized d atabase resulting fr om the operation of one or more mobil e or fixed cameras c ombined with comp uter algorithms to read and convert im ages of registration plates and the char acters they contain into comput er-readable da ta.” (§ 1798.90.5, subd. (d); see Stats. 2015, ch. 532, § 3, eff. Jan. 1, 2016.) The “infor mation or data colle cted through the use of an ALPR syst em” is called “ ‘ALP R information. ’ ” (§ 1798.90.5, subd. (b).) The ALPR Law req uires persons operat ing an ALPR syste m (with exceptions not relev ant here) to “[m]ain tain reasonable secu rity procedures and practices . . . to protect ALPR infor mation from unauth orized access, destruction, use, mo dification, or disclos ure.” (§ 1798.90.51, subd. (a); see also § 1798.90.5, s ubd. (c).) Such persons are also required to implement “a

4 usage and privacy p olicy in order to ens ure that the collecti on, use, maintenance, shari ng, and disseminati on of ALPR informa tion is consistent with respect for individuals’ privac y and civil lib erties.” (§ 1798.90.51, subd. (b)(1).) This p olicy must addr ess various enumera ted subjects, including “[t]he authorized purposes for using th e ALPR system and collecting ALPR information ”; “ [a] description of how the A LPR system will be monitored t o ensure the se curity of the info rmation and compliance wit h appli cable privacy l aws”; “[t]he pur poses of, process for, and restrictions on, the sale, sharing, or transfer of ALP R information to ot her persons”; and “[t]he length of time ALPR informa tion will be retaine d.” (I d., subd. (b)(2).) The policy mus t be made “ a vailable to the public in writing, and, if the ALPR operator has an Inte rnet Web site, the u sage and privacy pol icy shall be posted conspicuousl y on that Internet Web site.” (Id., subd. (b)(1).) 4 In addition, “ [i] f an ALPR operator accesses or provides access to ALPR information,” it shal l “ [m] aintain a record of that access, ” including “ [t] he username of the per son who accesses th e information, and, as applicable, the organization or enti ty with whom the p erson is affiliated,” and “[t] h e purpose for accessing the inf ormation. ” (§ 1798.90.52, subd. (a).) The ALPR operator must further “ [r] equire that ALPR information only b e used for the authorized purposes described in the us age and privac y policy required by sub division (b) of Se ction 1798.90.51. ” (Id., subd. (b).) B. Analysis Plaintiff alleg e s that Parking Conc epts is an ALPR op erator but has not implemented or made publicly available a usage and privacy policy as 4 Similar requiremen ts are imposed on p ersons who access o r use ALPR systems. (§§ 1798. 90.5, subd. (a), 1798.90.53.) Additional p rovisions governing public ag encies are not applic able here. (§ 1 798.90.55.)

5 required by the ALP R Law. 5 The trial court susta ined Parking Conce pts’ demurrer on the gro und s that Plai ntiff failed to allege Parking Conce pts operated an ALPR s ystem and fail ed to allege harm wi thin the meaning of the ALPR Law. We agree with Pla intiff that the trial c ourt erred. 1. ALPR System Parking Concepts d emurred on the gro und that Plaintiff fa iled to include sufficient fa cts alleging the operation of an AL PR system. “A complaint must c ontain ‘[a] sta tement of the facts con stituting the cause of action, in o rdinary and concise language.’ (Code Ci v. Proc., § 425.10, subd. (a)(1).)” (Tho mas v. Regents of University of Califo rnia (2023) 97 Cal.App.5th 587, 61 0.) “ ‘[A] plain tiff is required only to set forth the essential facts with “ ‘ “ ‘particular ity sufficient to acqu aint a defendant wi th the nature, source a nd extent of [th e plaintiff ’ s] c ause of action. ’ ” ’ ” ’ ” (Id. at p. 611.) “ ‘ “ [W]e assume the truth o f the properly pleaded factual all egations, [and] facts that reas onably can be inferr ed from those expre ssly pleaded. ” [Citation.] But we d o not assume the tr uth of “ co ntentions, deduction s, or conclusions of law. ” [Citatio n.] We libe rally construe the co mplaint “ with a view to substantial j ustice between the parties, ” drawi ng “ all reasonable 5 Plaintiff alleg ed a nother cause of a ction under t he ALPR Law, on the ground that Parkin g Concepts’ access t o and use of his AL PR information was unauthorized b ecause Plaintiff had not “provided [Park ing Concepts] ... with authorization.” The trial court found Plain tiff failed to allege u nlawful access or use, notin g a federal district c ourt, in N avarro v. Data (C. D.Cal., Dec. 7, 2022, No. 2: 20 - CV -07 370-SVW-SK) 2022 WL 182803 59 (Navarro), h ad “concluded that the ALPR statute does not require tha t operators and end users obtain authori zation from vehicle owners before captu ring ALPR information.” Plain tiff does not ad dress this finding on appeal, and has therefore forfeite d any claim of error as to this cause of action.

6 inferences in favor o f the asserted cl aims. ” ’ ” (Frayo v. Mar tin (2024) 102 Cal.App.5th 1025, 1 033.) A s noted above, a n ALPR system i s “a searchable comp uterized database resulting f rom the operation of one or more mobile or fixed cameras combined with comp uter algorithms to r ead and convert ima ges of registration plates and the character s they contain into com puter -readable data.” (§ 1798.90. 5, subd. (d).) Plaintiff alleges h is license plate num ber was displayed on the pri nted parking ticket he received when entering th e Garage and on a kiosk screen he pass ed when exiting. Plainti ff further alleged he did not authorize Parki ng Concepts’ collecti on of his license plat e information. It is an entirely reaso nable inference that Parking Concepts was able to display Plaintiff’s licen se plate number on his parking ti cket a nd the kiosk screen b y use of an automated system that took a photograph of h is license plate and used a computer pro gram to auto matically convert the image i n the photograph to comp uter -readable data. It is also a re asonable inference th at Parking Concepts st ores this compu ter-readable data — at le ast temporaril y — in a searchable data base. 6 Contrary to Parking C oncepts’ argument, Plaintiff was not require d to allege that it shares ALPR i nformation with oth er entities or uses it fo r any particular purposes. P laintiff ’ s complaint sufficiently alleges t hat Parking C oncepts operates an ALPR system. 2. Harm Under t he ALPR La w, “an individ ual who has been har med by a violation of this title, including, but not l imited to, unauthori zed access or use of ALPR informatio n or a breach of sec urity of an ALP R system, may bring a 6 Parking Concepts d id not argue, in its d emurrer or on ap peal, that license plate inform ation must be stored in a d atabase for some min imum period of time in ord er to constitute an A LPR system.

7 civil action in any co urt of competent jur isdiction against a p erson who knowingly caus ed the harm. ” (§ 1798.90.54, su bd. (a), itali cs added.) Par king Concepts argues Pla intiff failed to allege that he was “harme d” by any violation. Th is issue turns on the meaning of the word “harm” for pur poses of the ALPR Law. “In inte rpreting a statute, we begin with its te xt, as statutory language typically i s the best and most reliable indicator of the Legislature’s intended purpo se. [Citations.] We consider the o rdinary meaning of the language in questio n as well as the te xt of related prov isions, terms used in other parts of the st atute, and the struc ture of the statutory scheme. [Citations.] If the st atutory language in question remains a mbiguou s after we consider its text and the statut e’s structure, th en we may look to various extrinsic sources, su ch as legislative hist ory, to assist us in g leaning the Legislature’s i ntended purpose.” (Larki n v. Workers’ Comp. Appeals Bd. (2015) 62 Cal.4th 152, 157 – 158.) As an initial matter, and as Parking Concepts properly co ncedes, the ALPR Law does not require a plaintiff to suffer measurable monetary damages in order to establish harm. U nder the ALPR Law, a court may award “ [a]ctual dam ages, but not le ss than liquidated da mages in the amount of two thousand five hundred dollars ($2,500),” as w ell as punitive d amages, attorney fees, and i njunctive relief. (§ 1798.90.54, subd. (b), italics added.) The provision of a s et amount of liquida ted damages demon strates a legislative intent th at cognizable h arm does not require a measura ble monetary injury. (C f. Lieberman v. KCOP Television, Inc. (2003) 11 0 Cal.App.4th 156, 16 6 – 167 [in statute a ut horizing civil action by pers on “ ‘ injured by ’ ” prohi bited recording of co nfidential com munication, “the ter ms ‘injured’ and ‘a ctual damages’ ” were not “synony mous” because stat ute

8 provided for an “alte rnative statutory da mages” award]; Miller v. Collec tors Universe, Inc. (2 008) 159 Cal.App.4th 988, 1000, 1002 [in statute prohibiti ng misappropriating a nother’s name for co mmercial purpo ses, alternative statutory damage a ward for “ ‘injur ed party’ ” was incl uded because, “[u]nli ke an entertainm ent or sports star, no ncelebrit y plaintiffs often could not prove damages under the common law”].) Thus, “harm” wit hin the meaning of t he ALPR Law is not li mited to injurie s resulting in meas urable dama ges. Plaintiff argue s that harm results fr om any viol ation of the ALPR L aw. We disagree. The st atutory language li miting civil actions to person s “ harmed by a violati on” against defenda nts who “caused the harm ” in dicates that more than just the fact of a vio lation is required. In contrast, o ther statutes contain lan guage expressl y impos ing liability for “ violations. ” For example, the Fair D ebt Buying Practice s Act (§ 1788. 50 et seq.) provides, “ [A] debt buyer that viol ates any provision of this title with respect to any person shall be liable to th at person ” for actual or statut ory damages. (§ 1788.62, subd. (a), italics add ed; see also Ch ai v. Velocity Investme nts, LLC (2 025) 108 Cal.App.5th 1030, 1 040 [holding F air Debt Buying Pra ctices Act “ ex pressly authorizes consume rs who receive n oncompliant collec tion letters to sue for the violation of thei r statutory righ ts, and nothing in t he statute suggests that any injury beyo nd the noncomp liance is required to impose civil liability ” ].) Similarl y, the ALPR Law’s inclusion of two examples of harm - causing violations i ndicates that more t han just a violation is required, as th ere would be no n eed to provide exam ples if any violation was suffic ient. (See § 1798.90.54, subd. (a) [authorizing a civil action by “a n individual who has been harmed by a violation of this ti tle, including, but n ot limited to, unauthorized access or use of ALPR info rmation or a breach of security of an ALPR system ”].)

9 To the extent t he plain language i s amb iguous on this p oint, the legislative history provides support for our constr uction. A s introduced, the relevant language p rovided that “ an individual who ha s been harmed by a violation of this title may bring a civil ac tion in any court of competent jurisdiction against a person who knowingly caused that vio lation.” (Sen. Bill No. 34 (2015 – 201 6 Reg. Sess.) § 3, as introduced Dec. 1, 2014, italics added.) A single amendmen t both added the tw o examples of harm -causing violati ons and changed the en d of the sente nc e from “ violation ” to “ harm, ” resul ting in the language appea ring in the enacted statute: “ [A] n individual who has been harmed by a violati on of this title, including, but not li mited to, unauthorize d access or use of ALP R information or a b reach of security of an ALPR system, may bring a civil act ion in any court of competent jurisd iction against a person who knowin gly caused the harm. ” (Sen. Bill N o. 34 (2015 – 2016 Reg. Sess.) § 3, as a mended July 2, 20 15, italics added; § 1798.9 0.54, subd. (a); s ee also Navarro, s upra, 2022 WL 18 280359, p. *6 [fi nding the A LPR Law amendment replaci ng “violation” with “ harm” shows th e Legislature “ intended harm to b e distinct from a tec hnical violation of t he statute that is not accompanied by actual harm ”].) The two changes m ade in tandem indicate a legislativ e intent to requ ire harm bey ond a mere statutory violation. Our conclusion t hat harm requires more than jus t a violation of the ALPR Law does not resolve the issue bef ore us, however. We must d etermine whether such harm is present here; that is, whether an ALPR operator’s collection and use of an individual’s ALPR information, without implementing the re quired publicly available policy en suring that th is collection and use “is consistent wit h respect for individuals ’ privacy and civil

10 liberties” (§ 1798.9 0.51, subd. (b)(1)), harms that individual within the meaning of the ALP R Law. Parking Concepts a rgues that har m requires som e type of affirmativ e misuse or mishandli ng of a plaintif f’s ALPR information, and therefore simply collecting an d using the informa tion without the req uisite policy is not enough. This constr uction of harm appears to have be en adopted by a federal district court consid ering an ALPR Law challenge to parking garage operators, which fou nd on summary judgment that the plaintiffs fail ed to establish actual har m because the record did not “show[] that any [d]efendant’s improper hand ling of data led to its misu se.” 7 (Navarro, supra, 2022 WL 182803 59, p. *8.) Moreove r, the two ex amples of harm -causing violations provided i n the ALPR Law —“unauthorized ac cess or use of ALPR information or a bre ach of security of an ALPR s ystem” (§ 1 798.90.54, subd. (a)) — both rep resent scenarios in which info rmation was in f act 7 In another district court case, Mata v. Digital Recogniti on Network, Inc. (S.D.Cal., Mar. 25, 2022, No. 21- CV -1485 J LS (BLM)) 2022 WL 891433 (Mata) (opinion vac ated in part on reco nsideration (S.D.Cal., May 6, 2022, No. 21 - CV -1485 JLS (BLM)) 2022 WL 1445225), the plaint iff sued a private company that collec ted and sold ALPR i nformation. The dis trict court did not consider harm for purposes of the ALPR Law, but fou nd the plaintiff had not alleged sufficie nt injury for pur poses of f ederal court sta nding becaus e, for example, there were no allegations that the defendant “ actually disclose d ” the plaintiff’s ALPR information to thir d parties or “ in fact. . . misused ” thi s information. (M ata, pp. *5 – *6.) M ata, like Navarro, appeared to req uire some type of misuse or mishandling of A LPR information. But Mata i s of limited relevance be cause its analy sis was not based o n the harm required by the ALPR Law; inst ead, it determi ned the harm necess ary to establ ish federal court standi ng.

11 affirmatively misus ed or mishandled, suggesting supp ort for so limiting th e requisite harm. 8 However, considerat ion of the overall sta tutory scheme weig hs again st such a construction. Significantly, t he ALPR L aw does not impose specific substantive require ments on private en tities’ collection and use of ALPR data. 9 Instead, t he substanti ve requirements imposed by t he ALPR Law are stated in fairly gene ral terms. (See § 1798.90.51, su bd. (a) [ALPR op erators must “[m]aintain re asonable security pr ocedures and practi ces”]; id., subd. (b)(1) [usage a nd privacy policy m ust “ensure” that th e handling of ALPR information “ is consistent with respect for i ndividuals’ privacy and civil liberties”].) Accordingly, the ALPR Law vests pri vate entities th at collect and us e ALP R information with wide leeway to determine what to do with this data. Th us, r equir ing AL PR operators t o establish and make pub lic a policy governing use and maintenance of this data is a primary fo cus of the ALPR Law. This requirem ent ensures bot h that ALPR oper ators consider and make deliberate dec isions on this is sue, and that indiv iduals can kno w when and how their ALPR inform ation is being collect ed and use d. In oth er words, 8 The bill enacting th e ALPR Law also added ALP R informati on to an existing law requiri ng individuals be notified of data breaches of certain personal informatio n. (Stats. 2015, c h. 532, §§ 1 – 2; see §§ 1798.29, subd. (g)(1)(G), 1798.82, subd. (h)(1)(G).) 9 Legislative reports on the bill enac ting the ALPR La w note that, in previous legislative sessions, two bills h ad been introd uced which wo uld have imposed such restri ctions, b ut neither was succe ssful. (Se e Assem. Com. on Privacy and Consu mer Protection, Rep. on Sen. Bill N o. 34 (2015 – 2016 Reg. Sess.) as amen ded July 2, 2015, p. 7 (hereafter A ssem. Priv acy Com.).) With respect to public agencie s, the ALP R Law provides the y “ shall not sell, share, or transf er ALPR informatio n, except to an other public agency, and only as ot herwise permi tted by law. ” (§ 1798.90.55, su bd. (b).)

12 while the ALPR La w does not imp ose specific restrictions o n the use of ALPR information, it grants individuals the right to kn ow which entities a re collecting their ALPR data and how it is being us ed and maintained. Collecting and main tain ing individ uals ’ ALPR informat ion without implementing and making public the statutorily requ ired policy ha rms these individuals by viola ting this right t o know. In addition, the poli cy requirement is critical in holding ALPR operators accountab le as contempl ated by the ALPR Law. As noted above, one of the examples of a harm-causi ng violation is the “ unauthorized... use of ALPR informatio n. ” (§ 1798.90.54, subd. (a).) But, within the gen eral substantive rules es tablished by the AL PR Law itself, the authorized uses are determined by e ach ALPR operator and shown in their policy. (§ 1798.90.51, sub d. (b)(2)(A) [policy shall include “[t]he auth orized purposes for using the ALPR system and collecting ALPR inform ation” ].) The authorized uses deli neated in the policy apply not only to the ALPR operator, but to anyone who receives A LPR information fr om that op erator: “If an ALPR operator acce sses or provides acc ess to ALPR inf ormation,” it shall “[r]equire that ALP R information o nly be used for the authorized pur poses describ ed in the usa ge and privacy polic y required by subdi vision (b) of Section 1798.90.51.” (§ 1798.90.52, su bd. (b).) If an ALPR o perator has fai led to implement and m ake public the statutorily required policy establ ishing authorized uses, it i s much more diff icult to hold them accountable fo r unauthorized use s, even though this is an example of a harm-causin g violation expressly s tated in the ALPR L aw. This furth er underscores the significance of the p ublicly availa ble policy to the ALPR La w ’s statutory scheme.

13 T he legislative histo ry of the bill enactin g the ALPR Law supports th is understanding of th e statute. Leg islative reports highl ighted the m assive amount of ALPR da ta being collected by both public an d private entities: “ Databases mainta ined for northern California law enf orcement ag encies, San Diego law enfor cement agencies, an d private companies (such as insurance companie s, collections ag encies, and private investigators) contain 100 million, 49 mil lion, and more t han 1 billion l icense plate scans, respectively.” (Sen. Rules Co m., Off. of Sen. Floor Analyses, unfinished business analysis of Sen. Bill No. 34 (2015 – 2016 Reg. Sess.) as amen ded Sept. 1, 201 5, p. 4 (here af ter Sen. Floor); see also Assem. Pr ivacy Com., a t p. 4 [“ ALPR systems ope rate by automatical ly scanning any license plate within range. Some ALPR systems can scan up to 2,000 license pla tes per minute. In the private sector, ALPR s ystems are used to monitor par king facilities and assist repo ssession comp anies in ide ntifying vehicles, an d even gated communities use AL PRs to monitor and regulate access. ”].) Legislat ive reports emphasized the privacy interest s at stake in t his mass collec tion of ALPR information: “ The collection of a l icense plate number, location, and time stamp over mu ltiple time points ca n identify not o nly a person’s exact whereabouts but als o their pattern of m ovement. Unlike ot her types of personal informatio n that are covered b y existing law, civilians are not always aware when their ALPR data is being collected. ” 10 (Sen. Floor, at p. 5.) 10 As a committee rep ort noted, “ whil e ALPR does not id entify a specific person by itself .. . , it can be linked to a n identifiable perso n through a registration databas e, like that operated by the Depart ment of Motor Vehicles.” (Assem. Privacy Com., at p. 4.)

14 Against this backdrop, t he legislative re ports repeatedl y identify the purpose of the bill a s increasing tra nsparency to s upplement privacy protections. As one report stated, “ This bill is intende d to bring greater transparency to the use of ALPR sy stems by requiring o perators and end- users, as defined, to adopt an ALPR usage and privacy policy . . ..” (Assem. Privacy Com., at p. 4.) Another rep ort explained, “ [T] he right to priv acy is a fundamental right p rotected by Section 1 of Article I of the California Constitution. This bill woul d build upon that fundam ental right by requiri ng entities that collect, use, share, or disse minate information derived fr om an automated license p late reader system t o disclose how such information is gathered and used....” (Sen. Com. on Judiciary, Ana lysis of Sen. Bill No. 34 (2015 – 2016 Reg. Sess.) as introduce d, p. 7 (hereafter Sen. J udiciary); see also Sen. Floor, at p. 5 [“This bill will put in place minimal priva cy protections b y requiring the establ ishment of privacy a nd usage protection policies for ALP R operators and end u sers. This bill does not prevent the aut horized sharing of data, but if data is shared, i t must be justified a nd recorded.” ].) Thus, the legislative history clarifies that req uiring ALPR operators to implem ent and make public a usage and privacy policy wa s a significa nt end in itself, designed to ensure i ndividuals kno w how their data is being used and to help protect their privac y interests. This legislative history supports const ruing “harm” to include the collection and use of an ind ividual’s ALPR info rmation without such a polic y. To be sure, the facts alleged here do not mirror the widespre ad and involuntary collectio n of ALPR infor mation descri bed in the legislativ e history. But in enac ting the ALPR Law, the Legislatur e did not exem pt ALPR operators wh o maintain only a si ngle camera or colle ct ALPR

15 information fro m only a single, eas ily avoidable location. 11 Absent any indication in the pla in language ex empting such A LPR operators fro m liability, we see no basis to do so. Accordingly, we con clude that Plaintiff ’s allegation that Par king Concepts collected a nd used his ALPR i nformation without implementing or making publicly ava ilable a usage and privacy policy con stitutes “harm” within the meaning of the ALPR L aw. II. UCL Plaintiff alleg ed a cause of action f or violation o f the UCL b ased on Parking Concepts’ a lleged violation of th e ALPR Law and fai lure to disclose its use of an ALPR s ystem to custo mers. Parking Conce pts demurred on the ground, among othe rs, that Plaintiff failed to allege fac ts supporting UCL standing, and the tr ial court sustained t he demurrer. W e affirm. “UCL prohibits ‘unf air competition,’ def ined as ‘any unlawf ul, unfair or fraudulent business act or practice and unfair, deceptive, u ntrue or misleading advertisi ng and any act proh ibited by [. .. the false adver tising law].’ ([Bus. & Prof. Code,] § 1720 0; [citation].)” (Suchard v. Sonoma Academy (2025) 109 Cal.App.5th 1089, 1096 (S uchard), cita tion omitted.) “ To have standing to bri ng an action under t he UCL, a person must have ‘suffered injury i n fact and [have] lo st money or pr operty as a result of the unfair competition.’ ([Bus. & Prof. Code,] § 17204; [cit ation].) Such injury is ‘ “an invasion of a le gall y protected interest which is (a) c oncrete and particularized, [cita tions]; and (b) ‘actua l or imminent, not “ conjectural” or 11 Indeed, legislative reports su ggest privacy concerns are still implicated in such s cenarios given “ the ease with whic h license plat e data can be ... aggregated.” (Sen. Judiciary, at p. 7.)

16 “hypothetical.” ’ ” ’ [Citation.] The injur y must ‘ “affect the plaintiff in a personal and indivi dual way” ’ [citation ], and it must be eco nomic.” (Ibid.) Plaintiff ’s claimed i njuries of a “risk of future identity t heft” and “a loss of value of [his personal identif ying informat ion]” are to o speculative t o support UCL standi ng. (See Moore v. Centrelake Medical Group, Inc. (2022) 83 Cal.App.5th 51 5, 538 [the plaintiffs’ allegati on of loss of value in their personal informatio n stolen from de fendant was insuff icient for UCL standing because it “constitutes a concl usion or deducti on, unsupported by any properly pleade d facts, ” such a s that the plaintiffs “ever attemp ted or intended to particip ate in this mar ket [for their persona l information ], or otherwise to derive economic value from their [informat ion]”].) Plaintiff also cl aims that he would not have paid for p arking at the Garage had he kno wn his ALPR infor mation would be col lected. A similar injury based on a fai lure to disclose has been held insufficient. In Su chard, supra, 109 Cal.App. 5th 1089, a private high scho ol did not disclose misconduct by c ertain employees in volving other s tudents, and plain tiffs alleged “they would not have enroll ed their students in the school or paid th e school’s expensive t uition had defendan t not deceived t hem by failing to disclose the miscond uct of two teachers and a coach and the failure of the school to report it.” (Id. at p p. 109 2, 1098.) The Court of Ap peal held the plaintiffs failed to al lege sufficient injur y for purposes of the UCL be cause “there is no allegati on that the value of the education f or which plaintiffs p aid was reduced by the alleged improp rieties of three of the school’s em ployees toward other studen ts.” (Id. at p. 1098.) The cour t reasoned that, ev en if the plaintiffs assumed t he school would disc lose such misconduc t, they “ do not allege they dis cussed with d efendant, when the y were trans acting over tuition, their assum ption that the school would disclose suc h incidents, so we

17 fail to see how they did not receive the b enefit of their barga in.” (Id. at p. 1100.) Similarly here, Plaintiff does not alleg e that he discussed w ith Parking Concepts hi s assumption that h is ALPR informatio n would not be collected, and he rec eived the parking se rvices for which he paid. He has failed to allege econ omic injury to su pport UCL standi ng. Plaintiff does n ot contend he can a mend the com plaint to sufficiently allege UCL st anding. Accord ingly, we affirm th e order sus taining Parking Concepts’ demurrer to the UCL claim wi thout leave to amen d. (See Vann, supra, 97 Cal.App.5 th at p. 1020.) III. Constitutional Righ t to Privacy “ ‘[A] plaintiff alleging an invasion of privacy in violation of the stat e constitutional right to privacy mus t establish each of the foll owing: (1) a legally protected pri vacy interest; (2) a reasonable exp ectation of priv acy in the circumstances; and (3) conduct by defendant constituting a serio us invasion of privacy. ” (Mathews v. Bec erra (2019) 8 Cal.5th 7 56, 769 (Mathews).) We need not decide whether Plaintiff established the first t wo elements because we hold the facts alleged f ail to demonstrate a serious invasion of privacy. “ ‘[A]ctiona ble invasions of priv acy must be sufficie ntly serious in their nature, scope, and actual or p otential impact to c onstitute an egregiou s breach of the social norms underlying t he privacy right. Thus, the extent and gravity of the invasi on is [sic ] an ind ispensable consider ation in assessing an alleged invasi on of privacy.’ ” (Mathews, supra, 8 Cal.5th at p. 779.) “ ‘ [W] hether [a] defe ndant’s conduct constitutes a serio us invasion of privac y [is a] mixed questio n [] of law and f act. If the undisputed m aterial facts show. .. an insubstantial impact on privacy i nterests, the questio n of invasion may

18 be adjudicated as a matter of law. ’ ” (Fo lgelstrom v. Lamps Plus, Inc. (2011) 195 Cal.App.4th 9 86, 990.) Plaintiff relies on American Ci vil Liberties Union Foundation v. Superior Court (2017) 3 Cal.5th 1032 (ACLU), w hich involved a Calif ornia Public Records Act r equest for one week’ s worth of ALPR inf ormation captured by the Los Angeles Police Depa rtment and the Los Angeles County Sheriff’s Departmen t. (Id. at pp. 1 037 – 1038.) E ach of the two agenc ies captured license pla te data on wel l over one million veh icles per week, from cameras on fixed str uctures and on moving patrol cars. (Id. at p. 10 37.) The agencies retained th e data for two to fiv e years. (I bi d.) The Supreme C ourt considere d whether the reque sted recor ds were exempt from disclos ure under a “catchal l” provision applyin g when “ ‘the public interest serve d by not disclosing t he record clearly ou tweighs the public interest serve d by disclosure of th e record.’ ” (AC LU, supra, 3 Cal.5t h at p. 1043, quoting former Go v. Code, § 6255, s ubd. (a) [now Gov. Code, § 7922.000].) The c ourt reasoned, “ALP R data showing whe re a person was at a certain time co uld potentially reve al where that perso n lives, works, or frequently visits. A LPR data could also be used to identify people whom the police frequently en counter, such as wit nesses or suspects u nder investigation .. .. Although we ackno wledge that reveali ng raw ALPR data would be helpful in determining th e extent to wh ich ALPR technology threatens privacy, t he act of reveal ing the data would itself jeopardize the privacy of everyone associated with a sc anned plate. Give n that [the law enforcement agenci es] each conduct more than one mil lion scans per week, this threat to privac y is significant. ” (ACLU, at p. 1044.) While ACLU recogn izes that the collecti on of ALPR data im plicates privacy interests, it did not consider a co nstitutional pri vacy claim. More

19 significantly, the fac ts in that case stand in sharp contrast to those alleged here. ACLU consid ered millions of ALPR records gath ered from nu merous cameras covering a wide geographic are a; Plaintiff’s complaint alleg es the collection of ALPR informati on at only a single location, significantly reducing the privac y implications. ACLU involved ca meras mounted on patrol cars, such th at not only were ind ividuals likely unaware that their ALPR data was bei ng collected, bu t even if they were a ware, they co uld not avoid it (other than by refraining fro m driving or parking on public streets). In contrast, although Parkin g Concepts does not post si gns notifying customers of its use of ALPR inform ation, it disp lays a vehicle’s licen se plate number at entry an d exit, thereby providing some notic e that this information is being captured. Moreover, individ uals can avoid Parking Concepts’ collection of their ALPR information by not parking at the Gara ge. We hold that Parking Concep ts’ open col lection of ALPR information at a single locatio n, which an in dividual can avoid by not parking at th e Garage, is not an egregious breach of social privacy norms. Plaintiff offers no potential amendme nt and therefore fail s to demonstra te the trial court abused its disc retion in deny ing leave to amend.

20 DISPOSITION The trial court’s ord er sustaining P arking Concepts’ de murrer as to Plaintiff’s seco nd cause of action un der the ALP R Law, based on Pa rking Concepts’ failure to implement a usage and priv acy policy, i s reversed and remanded for furthe r proceedings. The order is otherwi se affirmed. Plaintiff is awarded his costs on appeal. SIMONS, Acting P. J. We concur. BURNS, J. CHOU, J. (A171546)

21 Brendan P. Barth olemew v. Parkin g Concepts, I nc. (A171546) Trial Court: Superior Court of C alifornia, City and County of San Francisco Trial Judge: Hon. Ethan P. Schu lman Counsel: B ursor & Fisher, L. Timothy Fisher, Julia K. Venditti and Philip L. Fraie tta for Plaintif f and Appellant. Gordon Rees Sc ully Mansukhani, C raig J. Mariam, Michael J. Dailey and Katiuska Pimentel Vargas for Defe ndant and Respondent.