Considering Flock under the Data Justice Act

What would happen if Flock's surveillance infrastructure had to comply with the framework I and my colleagues laid out in the Data Justice Act? Follow one vehicle record from camera to database to police search and prosecution, and see how the legal questions change along the way.

About five years ago, I began thinking about a different way to regulate government surveillance. I’d founded the Science & Surveillance Project at Brooklyn Defenders, and I was frustrated with the conversations that were live around surveillance at the time.

We were caught in a seemingly endless cycle of debating one technology after another. Facial recognition. Gunshot detection. Predictive policing. Cell-site simulators. Too often, those fights began after deployment, when the infrastructure for collecting and accumulating personal data was already in place.

And too often, those fights did not produce durable democratic outcomes. Many facial recognition bans crumbled; transparency and oversight statutes proved feeble in the face of state power.

From where I sat, on court benches side-by-side with community members turned clients, technologies were not anywhere close to the whole problem. What made them possible, and increasingly powerful, was the data.

Data extracted greedily and inequitably from Black communities. Data slipping into invisible systems before most of us had a chance to see. Data creating a devastating surveillance load borne disproportionately by segments of our cities, entrenching Ruha Benjamin’s New Jim Code.

I wondered what would happen if we stopped approaching surveillance technology by technology and instead started from a different premise: our personal data belongs to us. What would it mean to treat the government’s collection of that data as a taking or seizure of something that belongs to an individual? What authority would the government need to justify collecting, keeping, searching, sharing, or using it?

I asked Maneka Sinha to work through that thought experiment with me. Over the next several years, slowly by slowly, we developed what became the Data Justice Act (DJA), a framework grounded in personal data rights rather than any one surveillance tool. During this period, a lot changed: personally, among new kids and new cities and newly gray hair (at least for me), and professionally, among new jobs and the new technical capabilities we were faced with. The project changed too, eventually growing into a collaborative white paper developed through Maneka’s NYU Forensic Defense Clinic and my new Table, partnering with the Center on Race, Inequality and the Law.

The model legislation does not simply restate existing Fourth Amendment doctrine. Nor should it. It proposes a more stringent positive-law floor: statutory rights, obligations, and remedies governing the state’s collection and use of personal data.

Now that the model framework is published, I’ve been thinking about what it would mean in practice.

Let’s take the current Flock debate as our starting place.

Flock sells smart cameras and infrastructure that turn captured images into searchable data. Although commonly called license plate readers, its cameras capture much more: vehicles and the surrounding scene, potentially including car occupants, pedestrians, cyclists, animals, and other objects in view.

Flock uses automated image analysis to extract selected features from those image captures, including vehicle make, model, color, damage, and distinguishing features like bumper stickers, as well as the traditionally understood license plate numbers and registration states.

The system is also capable of detecting people. In September 2026, WIRED and 404 Media examined data and software recovered from a Flock camera. Its computer-vision software detected people, as well as bicycles, cars, and plates; the camera could produce dozens of images of a single passing car.

Those findings matter because what the camera captures, what its software detects, what the system extracts into structured data, and what police can ultimately search for are not necessarily the same things and they may not be the same over time.

Flock’s captured images and extracted features then become searchable within a broader investigative system. Police can search by plate and vehicle characteristics, receive hot-list alerts, and connect sightings across jurisdictions, subject to agencies’ sharing arrangements. Other Flock products support further analytics and connections to additional datasets.

So, suppose a city installs Flock cameras on public roads. I drive through this town. I am not suspected of a crime. Four cameras record my car at different locations, creating a record from which my travel path can be reconstructed.

Three days later, police investigate a burglary and search for a green SUV near the scene. My car appears. An officer reviews other sightings across other places and times; another agency may gain access. Eventually, a Flock record helps shape an investigation or prosecution.

That sequence sounds ordinary now.

The Data Justice Act makes almost every step in it legally significant.

Before the cameras ever go up

Most fights over surveillance technology begin with use: did police search for the wrong person? Misuse the database? Rely on faulty technology?

The DJA begins earlier:

• Section 4(A) provides that “surveillance technology” cannot “be acquired, deployed, or used without prior public notice, independent validation for reliability, and approval by an independent oversight body.”

  
  

• Section 2(K)’s definition of “surveillance technology” specifically includes license plate readers.

So, the first question is not whether an officer later misused Flock. It is: what process entitled the government to build this surveillance capacity in the first place?

That changes procurement from an administrative event into an exercise of public power requiring democratic and technical scrutiny.

Then my car passed the cameras.

One response to these cameras is that cars are visible on public roads. The camera merely records something an officer could have seen.

The DJA is built around different premises:

• Section 3(A) declares that “[i]ndividuals are the owners of their personal data,” and requires notice, due process, and lawful authority to take or seize critical categories of that data.

  
  

• Section 2(H) defines “personal data” to encompass information capable of being associated with an individual or group. And Section 2(B)(4) expressly includes location information: movement, travel routes, and travel patterns as a “critical category” of that data.

  
  

• Finally, Section 4(B) treats each act of collection or use as a “separate taking or seizure of personal property,” and 4(C) requires each collection to “satisfy standards of necessity, specificity, and proportionality,” prohibiting overbroad or untargeted collection.

So “the car was traveling on a public road” does not end the inquiry. What justifies creating a searchable location record about every vehicle passing this camera? Were the people whose location data was seized given notice and a process to contest the taking?

That is a much more upstream way of thinking about surveillance.

Now put the location records in a database

In August 2026, Flock announced a 7-day default retention period for new law-enforcement customers, down from thirty days, subject to exceptions and mechanisms to preserve selected records for investigations.

But the DJA exposes something important about retention length debates.

Answering how long government should keep data does not answer the critical question: why was the government entitled to database it at all?

The DJA defines databasing to include submitting, searching, enrolling, or storing personal data. Section 2(C). And even lawfully obtained data may be databased only where both the database itself and enrollment of that data are specifically authorized by law. Section 4(E)(3).

A shorter retention period can reduce privacy harms within an existing surveillance architecture. It does not, by itself, justify the architecture.

It’s worth noting that we have expressly regulated database architecture before. When the government built the forensic DNA database system, Congress and state legislatures enacted laws defining which categories of DNA profiles could enter those databases, who could access them, for what purposes, and under what conditions they could be removed. Those boundaries have expanded over time, sometimes in troubling ways. But they were the subject of lawmaking.

There is nothing inevitable about allowing private vendors and police departments to establish the architecture of mass surveillance first and asking the public to accept or contest it afterward.

Three days later, police search

Now the burglary has happened, and the officer searches Flock for the green SUV.

Here the DJA makes another important move: the original collection does not create a permanent government license to use the data.

The Act treats each collection and use as legally significant. Section 4(B). And lawfully obtained data may be used only for the specific purpose for which its collection or use was legally authorized. Section 4(E)(1).

Under this framework, possession of my car record does not resolve whether police may run this particular search.

The questions begin again: what is the lawful authority? Does this query fit the authorized purpose?

That is a very different conception of a government database from lawful possession means limitless lawful query.

Then the purpose changes

Suppose a city approved cameras to investigate stolen vehicles. Six months later, investigators want to use the data to identify people attending a protest.

Or a system justified by serious violent crimes gradually becomes routine in minor investigations.

The technological cost of that change is almost nothing. Once the data exists and the search interface is available, another query is easy.

The DJA tries to make that institutional drift legally expensive again.

It defines reuse as relying on personal data collected or used for one purpose for another purpose. Section 2(I). Lawfully obtained data cannot be transferred or reused unless the transfer or reuse is specifically authorized by law. Section 4(E)(2).

In other words, purpose limitation is not just something an agency writes in a policy manual. Purpose drift becomes a legal event.

That matters enormously in the surveillance stack. Interconnected systems gain their power by repurposing data, often before anyone outside the system knows a new use is even possible. The DJA would require legal authority for that expansion of state power, bringing decisions about reuse into view and making them open to contest.

Another agency wants access

Flock markets connected sightings and interagency collaboration, allowing cameras across jurisdictions to become more useful together.

Flock says customers control sharing permissions. But an administrator’s ability to grant access is not legal authority to share the data.

That is precisely what makes interoperability a form of power.

The DJA refuses to equate technical access with legal legitimacy. Data shared between jurisdictions without lawful authority is included within its definition of unlawfully taken or seized data. Sections 2(F)(5), 2(L)(5). And even lawfully obtained data cannot be transferred or reused unless specifically authorized by law. Section 4(E)(2).

Section 1(B) separately restricts voluntary distribution, transfer, or sale of personal data by covered government agencies to third parties or federal authorities.

So, the question stops being: did somebody turn sharing on? It becomes: what authority permits this institution to give another access to these people’s data?

Finally, follow the location record to court

Suppose a Flock search helps identify someone who is prosecuted.

The DJA’s discovery obligations reach information material to the defense even when it is technically held by contracted vendors and law-enforcement partners. Section 5(A)(2). Government must exercise and document due diligence, Section 5(A)(3), and disclose specified information about when data was collected or used, who handled it, and how it was databased, reused, transferred or processed. Section 5(A)(4).

Discovery should not begin and end with the surveillance image of a client’s car. Show me the lifecycle: Where was the camera? How extensive was the network? What did it capture? What metadata existed? What database was it connected to? What search query or queries and parameters were used? Who searched and what other results returned? Who accessed or shared the data? What was preserved and what remains with the vendor?

Not every item is expressly enumerated by the Act, but its disclosure framework requires asking what happened to the data.

Courts need that record to assess both what the system produced, and how state power moved through it.

And the Act attaches consequences.

When a person accused establishes a violation of the Act by a preponderance of the evidence, Section 5(B)(1) requires suppression of that affected evidence and its fruits. Section 5(A)(7) separately supplies remedies for discovery violations.

To vindicate the rights to be anonymous and forgotten, Section 3(B), unlawfully seized data must be destroyed and lawfully seized data generally sealed when the case ends. Section 6(A).

Follow the data

This exercise is not ultimately about Flock. The conventional picture of a license plate reader looks like:

Camera → Car → Police Search

The Data Justice Act asks us to see the architecture around it:

Authority to deploy → collection → databasing → retention → access → query → inference → reuse → sharing → state action → discovery → sealing or destruction

And at every stage, it asks the question that our current law too often postpones until the system is already built: what is the state legally entitled to do with this person’s data now?

Instead of debating each new tool after deployment, the DJA follows the data.

Flock is a technology question. The DJA turns it into a state-power question: under what circumstances may government collect, keep, connect, search, share, and act upon a record of who we are and where we have been?