Filed 7/20/26
CERTIFIED FOR PUBLICATION
COURT OF APPEAL, FOURTH APPELLATE DISTRICT
DIVISION ONE
STATE OF CALIFORNIA
GUILLERMO MATA, D084781
Plaintiff and Appellant,
v. (Super. Ct. No. 37-2021-
00023321-CU-MC-CTL)
DIGITAL RECOGNITION NETWORK,
INC.,
Defendant and Respondent;
SCOTT AKER,
Movant and Appellant.
APPEALS from a judgment and an order of the Superior Court of
San Diego County, Joel R. Wohlfeil, Judge. Affirmed.
Edelson and J. Aaron Lawson for Plaintiff and Appellant and Movant
and Appellant.
Matthew T. Cagle, Jacob A. Snow; Juelsgaard Intellectual Property and
Innovation Clinic, Mills Legal Clinic at Stanford Law School, Phillip R.
Malone, Nina K. Srejovic; and Nicole A. Ozer for the American Civil Liberties
Union of Northern California, the American Civil Liberties Union of
Southern California, the American Civil Liberties Union of San Diego and
Imperial Counties, the Center for Constitutional Democracy and the
Electronic Frontier Foundation as Amici Curiae on behalf of Plaintiff and
Appellant.
Kilpatrick Townsend & Stockton, Nancy L. Stagg, Xiao Jing Diego Wu
Min, Cole B. Ramey, Timothy E. Taylor and John D. Robinson for Defendant
and Respondent.
INTRODUCTION
California’s Automated License Plate Recognition (ALPR) statute
requires public and private ALPR operators and end-users to implement
certain procedural safeguards regarding the collection and storage of ALPR
information. (Civ. Code, 1 § 1798.90.5 et seq.) “[A]n individual who has been
harmed by a violation” of the statute is authorized to bring a civil action
against “a person who knowingly caused the harm.” (§ 1798.90.54, subds. (a)
& (b), italics added.) The question presented in this appeal is whether a
person, like Guillermo Mata, who alleges a violation of the ALPR statute but
identifies no resulting harm—other than his own subjective belief that his
privacy has been invaded by the collection and storage of his data—has
standing to sue under the ALPR statute. We conclude the answer is
no. Based on the plain text, standing under the ALPR statute requires actual
harm. For this reason, we affirm the trial court’s grant of summary
judgment in favor of Digital Recognition Network, Inc. (DRN) on the basis
that Mata, as class representative, lacked standing under the ALPR statute.
We also affirm the trial court’s order denying class member Scott Aker leave
to intervene as a named plaintiff on the basis he has forfeited any challenge
to the order.
1 All further undesignated statutory references are to the Civil Code.
2
BACKGROUND
I.
The ALPR Statute
Enacted in 2015, the ALPR statute (Stats. 2015, ch. 532, § 3, eff. Jan. 1,
2016) regulates both public agencies and private entities in the operation and
use of an “ ‘ALPR system,’ ” which is defined as “a searchable computerized
database resulting from the operation of one or more mobile or fixed cameras
combined with computer algorithms to read and convert images of
registration plates and the characters they contain into computer-readable
data.” (§ 1798.90.5, subd. (d); see §§ 1798.90.51, 1798.90.53, 1798.90.55.) It
sets forth certain requirements that an “ ‘ALPR operator’ ” must follow. 2
First, ALPR operators must “[m]aintain reasonable security procedures
and practices, including operational, administrative, technical, and physical
safeguards, to protect ALPR information from unauthorized access,
destruction, use, modification, or disclosure.” 3 (§ 1798.90.51, subd. (a).)
Second, ALPR operators must “[i]mplement a usage and privacy policy
in order to ensure that the collection, use, maintenance, sharing, and
dissemination of ALPR information is consistent with respect for individuals’
privacy and civil liberties.” (§ 1798.90.51, subd. (b)(1).) The usage and
privacy policy must be made available to the public in writing and be “posted
conspicuously” on any website maintained by the operator. (Ibid.)
2 An “ ‘ALPR operator’ ” is “a person that operates an ALPR system, but
does not include a transportation agency when subject to Section 31490 of the
Streets and Highways Code.” (§ 1798.90.5, subd. (c).)
3 “ ‘ALPR information’ means information or data collected through the
use of an ALPR system.” (§ 1798.90.5, subd. (b).)
3
Additionally, the usage and privacy policy “shall, at a minimum,” include the
following seven items of information:
“(A) The authorized purposes for using the ALPR system and
collecting ALPR information.
“(B) A description of the job title or other designation of the
employees and independent contractors who are authorized to
use or access the ALPR system, or to collect ALPR information.
The policy shall identify the training requirements necessary for
those authorized employees and independent contractors.
“(C) A description of how the ALPR system will be monitored to
ensure the security of the information and compliance with
applicable privacy laws.
“(D) The purposes of, process for, and restrictions on, the sale,
sharing, or transfer of ALPR information to other persons.
“(E) The title of the official custodian, or owner, of the ALPR
system responsible for implementing this section.
“(F) A description of the reasonable measures that will be used to
ensure the accuracy of ALPR information and correct data errors.
“(G) The length of time ALPR information will be retained, and
the process the ALPR operator will utilize to determine if and
when to destroy retained ALPR information.” (§ 1798.90.51,
subd. (b)(2)(A)–(G).) 4
Third and last, if an ALPR operator accesses or provides access to
ALPR information, it must maintain a record of that access and require the
4 The ALPR statute similarly requires that an “ ‘ALPR end-user,’ ”
generally defined as “a person that accesses or uses an ALPR system”
(§ 1798.90.5, subd. (a)(1)–(3)), maintain reasonable security procedures and
practices to protect ALPR information from unauthorized access, destruction,
use, modification, or disclosure (§ 1798.90.53, subd. (a)); and implement and
make available a written usage and privacy policy to the public and post it
conspicuously on the end-user’s website (§ 1798.90.53, subd. (b)(1)–(2)).
4
ALPR information only be used for the authorized purposes described in the
usage and privacy policy. (§ 1798.90.52, subds. (a)–(b).)
Significantly, the ALPR statute does not restrict or place limitations on
a private entity’s collection or use of ALPR information. (See Bartholomew v.
Parking Concepts, Inc. (2026) 118 Cal.App.5th 438, 449 (Bartholomew) [“the
ALPR [statute] does not impose specific substantive requirements on private
entities’ collection and use of ALPR data”].) 5 It does, however, impose
restrictions on public agencies: a “public agency that operates or intends to
operate an ALPR system shall provide an opportunity for public comment” at
a public meeting before its implementation, and it “shall not sell, share, or
transfer ALPR information, except to another public agency, and only as
otherwise permitted by law.” 6 (§ 1798.90.55, subds. (a)–(b).) By contrast, the
ALPR statute “vests private entities that collect and use ALPR information
with wide leeway to determine what to do with this data.” (Bartholomew, at
p. 449.)
II.
The ALPR Statute’s Private Right of Action
The ALPR statute allows a private right of action under section
1798.90.54. It provides: “In addition to any other sanctions, penalties, or
remedies provided by law, an individual who has been harmed by a violation
of this title, including but not limited to, unauthorized access or use of ALPR
5 Bartholomew, supra, 118 Cal.App.5th 438, was decided while this
appeal was pending. As such, we invited and considered the parties’
supplemental letter briefs addressing the impact of the decision in this case.
6 “ ‘Public agency’ means the state, any city, county, or city and county,
or any agency or political subdivision [thereof], including, but not limited to,
a law enforcement agency.” (§ 1798.90.5, subd. (f).)
5
information or a breach of security of an ALPR system, may bring a civil
action in any court of competent jurisdiction against a person who knowingly
caused the harm.” (§ 1798.90.54, subd. (a), italics added.)
In such an action, the court may award any combination of actual
damages, but not less than liquidated damages of $2,500, punitive damages
upon proof of willful or reckless disregard of the law, reasonable attorney fees
and costs, and other preliminary and equitable relief deemed appropriate.
(§ 1798.90.54, subd. (b)(1)–(4).)
III.
DRN’s ALPR Business
DRN is an “ALPR operator” within the meaning of the ALPR statute. 7
It “offers license plate recognition services to customers in the private sector.”
It sells ALPR hardware, including mobile and fixed cameras that are
mounted on vehicles like tow trucks or other physical infrastructure, with the
integrated software to capture images of license plates on vehicles in areas
visible to the public. DRN stores the original images from its cameras and
their associated computer-readable data in an ALPR system that it owns and
maintains.
The information in DRN’s ALPR system includes images of license
plates and vehicles, with the date, time, and location the images were
captured, as well as the license plate characters and state captured from the
images. In May 2024, DRN’s ALPR system contained “over 9 billion
historical license plate images.”
7 Although Mata’s complaint alleged that DRN qualified as either an
ALPR operator or ALPR end-user, Mata describes DRN solely as an ALPR
operator in his appellate briefing. We thus omit any discussion of Mata’s
allegations under section 1798.90.53, subdivision (b), which pertains to the
regulation of an ALPR end-user.
6
The parties agree that, in late 2015, DRN adopted an ALPR usage and
privacy policy (DRN’s policy) and did so “in a deliberate and conscious
manner.” The policy was drafted by DRN’s founder and former executive
chairman, Todd Hodnett, “who looked at the [ALPR] statute and drafted the
[policy], and then obtained approval from his CEO, CTO, and outside
counsel.” DRN’s policy includes the seven items of information required by
the ALPR statute. (See § 1798.90.51, subd. (b)(2)(A)–(G).) The policy is
hyperlinked at the bottom of the homepage of DRN’s website under the title
“California ALPR policy.”
DRN’s policy identifies three “authorized uses” of its ALPR system: by
its “customers to identify or ascertain the location of a specific vehicle under
circumstances when there is a legitimate commercial interest”; by “law
enforcement agencies for law enforcement purposes”; and by DRN “to make
[A]LPR data available to customers and law enforcement agencies for the
purposes above, and to provide market research information to customers
based on aggregated [A]LPR data.” (§ 1798.90.51, subd. (b)(2)(A).) It
identifies its users and their training requirements, specifically providing
that “[a]ll independent contractors of the company are authorized to use the
ALPR system for purposes consistent with their underlying contract with the
company and this policy.” (§ 1798.90.51, subd. (b)(2)(B).) In accord with that
statement, DRN requires all third parties to execute a written contract in
which the third party agrees to comply with all applicable laws, including
state privacy laws, when accessing and using information stored in the ALPR
system. Additionally, DRN’s policy describes its monitoring process to ensure
security and compliance with applicable privacy laws, including conducting
periodic audits of its usage logs.
7
IV.
Mata’s Class Action Lawsuit
In 2021, Mata filed a putative class action lawsuit against DRN on
behalf of “[a]ll persons in the State of California whose license plate data was
collected by [DRN] using an automatic license plate reader.” 8 The complaint
contained a single cause of action: an asserted violation of the ALPR statute
by DRN.
Mata alleged that although DRN maintains a written privacy and
usage policy on its website, it does so only “to maintain the appearance of
adhering” to the ALPR statute and “to pay lip service to privacy laws without
having any intention of actually complying with them.” Specifically, he
alleged DRN violated section 1798.90.51, because it (1) “does not make a
meaningful usage and/or privacy policy available to the public, nor does it
conspicuously post any information about usage and/or privacy on its
website”; (2) “does not implement a meaningful usage and privacy policy in
order to ensure that its collection, use, maintenance, sharing, and
dissemination of ALPR information is consistent with respect for individuals’
privacy and civil liberties”; and (3) “expressly disclaims the highly sensitive
nature and serious privacy implications of its ALPR data, and as a result
fails to conduct the security procedures and practices reasonably necessary to
protect such sensitive information from unauthorized access, destruction,
use, modification, or disclosure.” He further alleged DRN violated section
1798.90.52, subdivision (b), because “it allows, and indeed encourages its
8 The complaint, along with other documents that were filed in the trial
court but omitted from the clerk’s transcript, is one of the exhibits submitted
by DRN in an unopposed motion to augment the appellate record, filed on
August 21, 2025. We hereby grant DRN’s motion to augment.
8
customers to use its ALPR system for the unauthorized purpose of tracking
and locating individuals.”
As for harm, Mata asserted that “[he] and the Class have been harmed
by [DRN’s] conduct because their private and sensitive personal information
has been improperly collected and used without their notice or consent.”
(Italics added.) Mata further asserted he is “one of millions of individuals
who has fallen victim to DRN’s pervasive surveillance network,” as it has
“tracked Mata’s vehicle, thus gaining access to his home and work address
and other sensitive information such as the time he typically leaves and
comes home and where he likes to spend his free time.” His complaint states,
“This lawsuit seeks to put an end to DRN’s portentous surveillance tactics
and to hold the company accountable for disparaging the privacy rights of
California citizens.”
V.
The Trial Court Grants DRN Summary Judgment
DRN moved for summary judgment on two grounds: Mata lacked
standing to bring a civil action under the ALPR statute because he had not
been harmed by any alleged violation, and there was no evidence that DRN
had violated the ALPR statute. The trial court agreed that Mata lacked
standing and granted summary judgment for DRN on that basis. It did not
reach DRN’s second argument. 9
9 Before its motion for summary judgment, DRN had removed the action
to federal district court based on diversity jurisdiction. The district court
remanded the action back to the superior court, concluding that it lacked
subject matter jurisdiction because Mata failed to allege injury in fact to
satisfy standing under Article III of the United States Constitution. (Mata v.
Digital Recognition Network, Inc. (S.D. Cal., May 6, 2022, No. 21-CV-1485
JLS (BLM)) 2022 WL 1445225; see also Mata v. Digital Recognition Network,
9
In support of its showing that Mata lacked standing 10 DRN argued
Mata’s involvement in the lawsuit “does not arise out of any specific event or
injury he has suffered” and produced the following evidence. In his
deposition, Mata testified his ALPR information in DRN’s system has never
been the subject of a data security breach or unauthorized access or use. He
has not had his identity stolen, never been stalked, has not suffered any
physical injury or harm, has not lost any wages or suffered any monetary
damage because of any conduct by DRN.
When asked if DRN’s conduct caused him to suffer any mental anguish,
Mata testified: “[M]y privacy is something that I think—privacy I think is
something a lot of other people will agree that it’s very personal to them. [¶]
And for myself, my privacy is very important. I hold it to high—I think a lot
of people take a lot of precautions to protect their privacy. So for me, my
harm—the harm of mine, and I’m sure a lot of others would agree, is the
privacy has been—my privacy has been violated on multiple occasions.”
(Italics added.)
Inc. (S.D. Cal., Mar. 25, 2022, No. 21-CV-1485 JLS (BLM)) 2022 WL 891433
[explaining that Mata had not adequately alleged standing, as he failed to
identify any injury in fact].) After remand, DRN filed an answer and the trial
court certified the class, defined as “[a]ll residents of California whose
California license plate data was collected by [DRN] (either directly or
through an affiliate) in the State of California at least fifteen times between
June of 2017 and the date of final judgment.”
10 In support of DRN’s alternative argument that summary judgment was
proper because the undisputed evidence established it did not violate the
ALPR statute, DRN produced evidence of its security protocols; its usage and
privacy policy, which is available on its website; and its contracts and
requirements for its customers. We previously summarized this evidence in
the Background, section III.
10
Mata testified he decided to file this lawsuit when he learned about
ALPR technology in something he read. In his words, “One day, . . . I was at
home and it came across to me, I mean, I think it was some kind of—I forgot
what it was. It was maybe like an article or something talking about how
companies are retrieving customer’s data. And I felt like that—that applied
to me, so, . . . not being an attorney, I didn’t know if it did or not. So that’s
when I reached out to my—to my attorney to just let them know, hey, this is
what I think, and then I let them decide from there.”
Although ALPR information for his vehicles had been collected by
DRN—the license plates for Mata’s two vehicles have each been captured at
least 15 times and appear in DRN’s ALPR system—Mata conceded his data
has only been accessed by his own attorneys, with his express authorization,
for this litigation. He also has never gone to DRN’s website to review DRN’s
usage and privacy policy, but has read it only “as part of the preparation for
the documents that [his] attorneys prepared.”
In opposition, Mata did not refute DRN’s evidence that he had not
suffered any direct harm because of DRN’s conduct, such as unauthorized
access or use of his ALPR information. 11 But in his view, “[t]he ALPR
statute is designed to protect [individual] privacy, and presumes that
invasions of privacy are harmful.” And any infringement of that “statutory
right” constitutes actionable harm. He asserted DRN violated his and class
members’ privacy rights by collecting “at least 15 license plate scans of every
11 Mata argued DRN was aware of “credential sharing,” which “is when
users share their login information with other people” and enables others to
gain unauthorized access to ALPR information, but failed to take reasonable
steps to prevent it. Although he argued credential sharing is “a form of
unauthorized access,” Mata did not produce any evidence of an actual
occurrence of this with his own ALPR information.
11
Class member,” while maintaining “a meaningless, non-compliant usage and
privacy policy, failing to enact reasonable data security protocols, and failing
to provide adequate notice to the public,” in violation of the ALPR statute.
The trial court did not agree with Mata’s theory of harm and granted
summary judgment in favor of DRN. Among other things, the court found
the undisputed evidence showed Mata had not sustained any physical,
mental or monetary injury due to DRN’s collection of ALPR data, and Mata’s
ALPR information has never been disclosed or accessed by anyone without
his consent. Construing the ALPR statute to require harm that is “the result
of some action which causes injury stemming from improper access or use of
ALPR data,” the court concluded there was no triable issue that Mata lacked
standing.
DISCUSSION
I.
Summary Judgment Was Proper Because Mata Lacks Standing
Appealing the judgment, Mata contends the trial court erred in its
interpretation of the ALPR statute’s standing requirement and summary
judgment should not have been granted. We review the trial court’s
summary judgment order and questions of statutory interpretation de novo.
(Olson v. La Jolla Neurological Associates (2022) 85 Cal.App.5th 723, 733
[summary judgment]; Bruns v. E-Commerce Exchange, Inc. (2011) 51 Cal.4th
717, 724 (Bruns) [statutory interpretation].) On our de novo review, we find
no error.
A. The Parties’ Competing Theories of Harm
Under the ALPR statute, “an individual who has been harmed by a
violation of this title, including, but not limited to, unauthorized access or use
of ALPR information or a breach of security of an ALPR system, may bring a
12
civil action . . . against a person who knowingly caused the harm.”
(§ 1798.90.54, subd. (a), italics added.) Mata’s standing turns on whether he
has been “harmed by a violation” of the ALPR statute. The parties offer
competing responses.
The relevant facts are not disputed. Mata’s ALPR information stored
in DRN’s system has never been the subject of unauthorized access or use, or
a data security breach. His ALPR information has not been accessed by
anyone except his own attorneys, with his authorization, in connection with
his lawsuit. He has not experienced any physical or monetary injury. Based
on these undisputed facts, DRN contends Mata has not been harmed within
the meaning of the ALPR statute. In DRN’s view, the “harm” which must be
shown to confer standing is actual harm.
Mata, in contrast, sets forth a broad theory of harm that he calls a
“collection-based invasion of privacy” harm. 12 He explains his theory as
follows: California recognizes “an invasion of privacy as itself harmful,
without the need to examine any consequences flowing from the invasion.”
Specifically, the “collection and retention of information about an individual,
by itself, threatens” this individual privacy interest. “Because DRN has
collected massive amounts of data about Mr. Mata, as well as every other
member of the class, they have intruded on [this] well-recognized privacy
12 Mata’s complaint asserted an even broader theory of harm, under
which the mere collection and use of ALPR information without his notice or
consent constitutes harm. This is not a viable theory because the ALPR
statute does not require an ALPR operator (or end-user) to provide notice or
obtain consent for the collection and use of ALPR information, nor does it
restrict or place any substantive limitations on a private entity’s collection or
use of ALPR information. (See Bartholomew, supra, 118 Cal.App.5th at
p. 449.)
13
interest.” “Having undertaken to do so, unless DRN’s collection of this data
comports with, and respects, Mr. Mata’s privacy interests and civil liberties,
. . . Mr. Mata can plausibly claim to have been ‘harmed’ by DRN’s actions.”
Put another way by Mata, “the collection of a sufficient number of scans
to reveal sensitive details about one’s life, and the storage of that data
indefinitely in a database that is not secured in the manner required by
California law, both because the database operator lacks a statutorily
compliant [usage and privacy] policy and has failed to implement necessary
security measures, is an actionable harm.” (Italics added.) He adds,
however, that he makes “no argument that any violation of the ALPR law, no
matter how technical, invades the privacy of those whose data has been
collected.” 13
As we understand Mata’s theory, the harm sufficient to confer standing
is the invasion of his privacy that results from the very collection and
retention of ALPR information that is permitted by the statute, so long as the
ALPR operator is out of compliance with a nontechnical provision of the
statute. We find no support for this theory in the text or the legislative
history of the ALPR statute, and conclude standing requires actual harm by
the violation.
B. Standing Under the ALPR Statute Requires Actual Harm
“Standing rules for actions based upon statute may vary according to
the intent of the Legislature and the purpose of the enactment.” (Angelucci v.
13 As Mata explained in his opposition to DRN’s motion for summary
judgment, “Some violations may not cause privacy harm in themselves, like if
an ALPR operator’s policy fails to identify ‘[t]he title of the official custodian,
or owner, of the ALPR system responsible for implementing this section,’ ”
quoting section 1798.90.51, subdivision (b)(2)(E).
14
Century Supper Club (2007) 41 Cal.4th 160, 175.) Thus, where a cause of
action is based on a California statute, standing is “a matter of statutory
interpretation.” (Adolph v. Uber Technologies Inc. (2023) 14 Cal.5th 1104,
1120.)
Our fundamental task in construing a statute is “ ‘to determine and
give effect to the intent of the enacting legislative body.’ ” (Holland v.
Assessment Appeals Bd. No. 1 (2014) 58 Cal.4th 482, 490.) We begin by
looking at the language of the statute because it is generally the most reliable
indicator of legislative intent, and we give it a plain and commonsense
meaning. (Ibid.) We do not examine that language in isolation, but in the
context of the entire statutory framework. (Bruns, supra, 51 Cal.4th at
p. 724.) “[W]e must follow the fundamental rule of statutory construction
that requires every part of a statute be presumed to have some effect and not
be treated as meaningless unless absolutely necessary. ‘Significance should
be given, if possible, to every word of an act. . . . Conversely, a construction
that renders a word surplusage should be avoided.’ ” (People v. Arias (2008)
45 Cal.4th 169, 180 (Arias).) “ ‘If the language is clear in context, our work is
at an end. If it is not, we may consider other aids, including the statute’s
legislative history.’ ” (City of Gilroy v. Superior Court (2026) 19 Cal.5th 38,
51.)
1. Statutory Text
Turning first to the plain text of the provision that authorizes a private
right of action—section 1798.90.54, subdivision (a) (hereafter
§ 1798.90.54(a))—we find several items significant to our construction of the
words, “harmed by a violation.”
First, section 1798.90.54(a) differentiates between the concept of harm,
on the one hand, and the concept of a statutory violation, on the other.
15
Specifically, an individual may bring suit if “harmed by a violation.”
(§ 1798.90.54(a), italics added). “When the Legislature uses different words
as part of the same statutory scheme, those words are presumed to have
different meanings.” (Romano v. Mercury Ins. Co. (2005) 128 Cal.App.4th
1333, 1343.) In choosing to make the violation itself distinct from the harm
that the violation causes, the Legislature requires both to be shown. Thus,
more than a mere statutory violation is required to confer standing to bring
suit. On this point, we agree with the court in Bartholomew, supra,
118 Cal.App.5th 438, when it rejected the plaintiff’s argument “that harm
results from any violation” of the ALPR statute.” (Id. at p. 447 [“The
statutory language limiting civil actions to persons ‘harmed by a violation’
against defendants who ‘caused the harm’ indicates that more than just the
fact of a violation is required.”].)
As the Bartholomew court observed, “[i]n contrast, other statutes
contain language expressly imposing liability for ‘violations.’ For example,
the Fair Debt Buying Practices Act (§ 1788.50 et seq.) provides, ‘[A] debt
buyer that violates any provision of this title with respect to any person shall
be liable to that person’ for actual or statutory damages.” (Bartholomew,
supra, 118 Cal.App.5th at p. 447, quoting § 1788.62, subd. (a) and citing Chai
v. Velocity Investments, LLC (2025) 108 Cal.App.5th 1030, 1040 (Chai); see
also Parsonage v. Wal-Mart Inc. (2026) 118 Cal.App.5th 399, 406, 420–421
[holding no showing of injury required under provision of the Investigative
Consumer Reporting Agencies Act (§ 1786 et seq.) that makes an employer
who “fails to comply with any requirement” of the statute liable to consumers;
collecting cases construing other statutes containing language expressly
imposing liability for violations].) These statutes demonstrate that the
Legislature knows how to create a statutory right and “deem a violation of
16
that right an injury sufficient to confer standing.” (Chai, at p. 1040.) The
Legislature did not do that with the ALPR statute.
Further still, section 1798.90.54(a), gives several non-exclusive
examples of how a plaintiff might be harmed by a statutory violation. It
authorizes suit by “an individual who has been harmed by a violation of this
title, including, but not limited to, unauthorized access or use of ALPR
information or a breach of security of an ALPR system.” (§ 1798.90.54(a),
italics added.) The “inclusion of [several] examples of harm-causing
violations indicates that more than just a violation is required, as there
would be no need to provide examples if any violation was sufficient.”
(Bartholomew, supra, 118 Cal.App.5th at p. 447.)
Second, the preposition “by” in the phrase, “harmed by a violation” is
used to connect “harmed” and “violation.” (§ 1798.90.54(a), italics added.)
Giving the word its usual meaning and effect, “by” explains what caused the
person to be harmed and means “as a result of” or “because of” the violation.
(People v. Cole (2004) 33 Cal.4th 1158, 1208 [“The preposition ‘by,’ in itself,
commonly signifies a causal connection.”].) The harm then must arise from
the violation.
Third, we turn to the dictionary definition of “harm.” As noted by the
district court in Navarro v. Skidata, Inc. (C.D. Cal., Dec. 7, 2022, No. 2:20-
CV-07370-SVW-SK) 2022 WL 18280359 (Navarro)), “[t]he ordinary meaning
of harm, according to the Merriam-Webster Dictionary, is ‘physical or mental
damage; injury.’ Black’s Law Dictionary is in accord, defining harm as
‘injury, loss, damage; material or tangible detriment.’ ” (Id. at p. *5.) From
the plain meaning of “harm,” among other reasons, the district court
17
concluded “actual harm is required to establish a violation of the California
ALPR statute.” 14 (Id. at pp. *5–*6)
Here we note the ALPR statute does not require a plaintiff to suffer
measurable monetary damages to establish harm. (See Bartholomew, supra,
118 Cal.App.5th at p. 447.) It allows recovery of actual damages or the
statutory minimum of $2,500 as liquidated damages. (§ 1798.90.54,
subd. (b)(1).) We agree with Mata that the Legislature’s inclusion of
statutory damages evinces the Legislature’s intention to allow a plaintiff to
recover for “difficult to quantify” harm. But it does not follow, as Mata
contends, that it signals the Legislature’s intention to authorize an individual
to bring suit based on the type of amorphous harm he has articulated.
Fourth, the Legislature provides three specific examples of how an
individual may be harmed by a violation of the ALPR statute:
(1) unauthorized access of ALPR information, (2) unauthorized use of ALPR
information, and (3) breach of security of an ALPR system. (§ 1798.90.54(a).)
All three are examples of actual, not abstract, harm. The interpretive canon
of ejusdem generis, meaning “of the same kind,” applies here. (Brown v. City
14 In Navarro, after discovering that ALPR technology was being used in
shopping mall parking lots, plaintiffs sued the shopping malls and the
manufacturers of the ALPR technology, alleging, among other things a
violation of the ALPR statute. (Navarro, supra, 2022 WL 18280359, at
pp. *1–*2.) The district court concluded that “actual harm” was required for
the plaintiffs to have standing under the ALPR statute (id. at p. *6), but that
plaintiffs had failed “to demonstrate actual harm that was caused by any
particular defendant” since “[n]othing in the record, for instance, shows that
any [d]efendant’s improper handling of data led to its misuse that could in
turn justifiably spark [p]laintiffs’ allegations of ‘identity theft,’ apparent
discovery of data on the ‘dark web,’ acquisition of credit monitoring services,
emotional distress, or diminution in value of personally identifying
information.” (Id. at p. *8.)
18
of Inglewood (2025) 18 Cal.5th 33, 43 (Brown).) “The canon, which ‘ “ ‘applies
whether specific words follow general words in a statute or vice versa,’ ” ’
instructs that ‘ “the general term or category is ‘restricted to those things that
are similar to those which are enumerated specifically.’ ” ’ ” (Ibid.)
Important here, the interpretive canon of ejusdem generis applies even
where the specifically enumerated items of the statute are preceded by the
words “including, but not limited to.” (Brown, supra, 18 Cal.5th at p. 43.)
And although Mata is correct that the words “including, but not limited to”
are “a phrase of enlargement,” it is “not necessarily a phrase without limits.”
(Ibid.) The phrase “must be read in conjunction with the examples the
statute sets forth” and while the phrase connotes an illustrative listing, “ ‘the
specific examples’ listed may restrict the meaning of the defined term.”
(Ibid.) Contrary to Mata’s argument, ejusdem generis “does not allow us to
ignore the restrictions the Legislature set or to broaden the meaning of [the
term to be interpreted] beyond the restrictions set forth in the Legislature’s
. . . example[s].” (Arias, supra, 45 Cal.4th at p. 180.) “The rule is ‘based on
the obvious reason that if the Legislature had intended the general words to
be used in their unrestricted sense, it would not have mentioned the
particular things or classes of things which would in that event become mere
surplusage.’ ” (Ibid.)
In sum, giving effect “to every word” in section 1798.90.54(a), we
conclude standing under the ALPR statute requires that a plaintiff must
demonstrate actual harm that arises from the violation. (Arias, supra,
45 Cal.4th at p. 180 [“Significance should be given, if possible, to every word
of an act.”].)
19
2. Legislative History
We have reviewed the legislative history, but we do not find that it
provides any further clarity as to the meaning of “harmed by a violation”
beyond the statutory text we have just discussed. However, the limited
information that we have gleaned is consistent with our construction of the
statute. 15
The ALPR statute was enacted by Senate Bill No. 34 in 2015. (Stats.
2015, ch. 532, § 3.) None of the committee reports or analyses for Senate Bill
No. 34 discuss the meaning of the requirement that, to file a lawsuit, an
individual must be “harmed by a violation” of the statute. (§ 1798.90.54(a).)
We also do not find the amendments made to the statutory language as it
proceeded through the Legislature to be particularly instructive on that
question. 16 (See Kaufman & Broad Communities, Inc. v. Performance
15 Mata’s discussion of the legislative history is mostly focused on
establishing that the Legislature viewed ALPR information as implicating
the public’s privacy interests, at least to some extent. Our review of
legislative history here has a more specific focus. Namely, we review the
legislative history to determine whether it sheds any light on what the
Legislature meant by “an individual who has been harmed by a violation” of
the statute. (§ 1798.90.54(a).)
16 In interpreting the private cause of action provision in the ALPR
statute, the district court in Navarro, supra, 2022 WL 18280359 at page *6,
focused on an amendment to Senate Bill No. 34, in which the phrase allowing
a lawsuit “against a person who knowingly caused that violation” was
changed to a phrase allowing a lawsuit “against a person who knowingly
caused the harm.” (Legis. Counsel’s Dig., Sen. Bill No. 34 (2015–2016 Reg.
Sess.) p. 15, as amended July 2, 2015, italics added.) Bartholomew also found
this amendment to be significant. (Bartholomew, supra, 118 Cal.App.5th at
pp. 447–448.) In our view, however, that language serves only to describe the
class of defendants who may be sued, not the class of plaintiffs who may sue.
20
Plastering, Inc. (2005) 133 Cal.App.4th 26, 31 [a court may consider different
versions of the bill as part of a legislative history analysis].)
However, two enrolled bill reports sent to the Governor provide some
relevant statements. “Enrolled bill reports are legislative history that may
be considered by courts in construing a statute.” (People v. Adir
International, LLC (2025) 114 Cal.App.5th 275, 324; see also Elsner v. Uveges
(2004) 34 Cal.4th 915, 934, fn. 19 [“we have routinely found enrolled bill
reports, prepared by a responsible agency contemporaneous with passage and
before signing, instructive on matters of legislative intent”].)
First, an enrolled bill report from the Department of Finance explains
that “[p]otential costs at the local level may arise from the following
requirements of this bill: . . . Damages resulting from civil actions brought by
individuals who have been harmed by improper use of [ALPR] system data.”
(Dept. of Finance, Enrolled Bill Mem. to Governor on Sen. Bill No. 34 (2015–
2016 Reg. Sess.) Sept. 10, 2015, p. 1, italics added.) Second, an enrolled bill
report from the California Highway Patrol states, “[Senate Bill No.] 34 would
permit anyone whose information is disclosed in violation of the sections
proposed by this bill to seek civil action against the individual who knowingly
caused the violation.” (Cal. Highway Patrol, Enrolled Bill Rep. on Sen. Bill
No. 34 (2015–2016 Reg. Sess.) Sept. 1, 2015, p. 1, italics added.) That same
report describes the following argument in favor of the bill: “This bill
outlines rules and regulations regarding the use of personal information and
the consequences for allowing that personal information to be obtained or
released without cause.” (Id. at p. 10, italics added.) The language we have
italicized above supports the conclusion that the ALPR statute was intended
to give an individual the right to sue when that individual’s ALPR
21
information has been improperly obtained, used or released, not merely when
that individual has identified a statutory violation.
DRN also cites a letter to the Governor from the Senate Republican
leader, urging him to veto the bill. That letter reflects the same
understanding of the statute as the enrolled bill reports discussed above, as it
refers to “a private cause of action for the release of any information collected
through the use or operation of an ALPR system.” (Sen. Jean Fuller, letter to
Governor Edmund G. Brown, Jr. re Sen. Bill No. 34 (2015–2016 Reg. Sess.)
Sept. 22, 2015, italics added.) To the extent that letter reiterates legislative
discussion, we consider it here. (People v. Grays (2016) 246 Cal.App.4th 679,
689, fn. 11 [“We recognize that ‘statements [in letters to the Governor] about
pending legislation are entitled to consideration to the extent they constitute
‘a reiteration of legislative discussion . . . rather than merely an expression of
personal opinion.” ’ [Citation.] The statement here is consistent with the
discussion in legislative analyses about the purpose of the bill.”]; see also
American Financial Services Assn. v. City of Oakland (2005) 34 Cal.4th 1239,
1263 [considering content of letters from Assembly Republican Leader and
Senate Republican Whip to the Governor urging a veto of a bill].)
Mata contends that his interpretation of the statute is supported by
provisions appearing in two pieces of proposed (but not enacted) legislation
concerning ALPR information in the years prior to the enactment of Senate
Bill No. 34. As we understand Mata’s argument, he intends to refer to
Senate Bill No. 893 from the 2013–2014 Regular Session and Senate Bill No.
1330 from the 2011–2012 Regular Session. However, Mata fails to support
his argument with any citation to the appellate record where that legislative
history is available. He also does not provide any legal authority allowing us
to base our interpretation of a statute on a provision appearing in failed
22
legislation from prior legislative sessions. “Unpassed bills, as evidence of
legislative intent, have little value.” (Graham v. DaimlerChrysler Corp.
(2004) 34 Cal.4th 553, 572.) We accordingly do not consider Mata’s
arguments concerning unpassed legislation when interpreting the meaning of
the ALPR statute.
In sum, the relevant statements we have identified in the legislative
history support the statutory meaning that we have derived from the words
of the statute itself. To have standing as someone “harmed by a violation of
the statute” (§ 1798.90.54(a)), a plaintiff must show actual harm arising from
a violation of the statute (see Navarro, supra, 2022 WL 18280359, at p. *8).
3. Mata’s Theory of Harm is Not Supported by the Statutory Text or
Legislative History.
We briefly turn back to Mata’s theory of a collection-based invasion of
privacy harm. As we explained, Mata contends the harm sufficient to confer
standing is the invasion of his privacy that results from the very massive
collection and retention of ALPR information that is permitted by the
Legislature, so long as the ALPR operator is out of compliance with a
nontechnical provision of the statute. His theory finds no footing in the
statutory text, or the legislative history we have just discussed.
The ALPR statute does not distinguish between a “technical” and
nontechnical requirement, and Mata does not explain how that distinction is
to be made. He does not identify any specific violation of the ALPR statute
that would not infringe on his privacy interests. Instead, without
elaboration, he asserts the failure to identify the “title of the official
custodian, or owner, of the ALPR system responsible for implementing” the
usage and privacy policy (see § 1798.90.51, subd. (b)(2)(E)) would be a
technical violation that, as his counsel explained at the summary judgment
motion hearing, could not “imagin[ably] . . . constitute a privacy harm or an
23
actionable harm for any particular individual out there.” We fail to perceive
why identification of the person responsible for implementing the very usage
and privacy policy that Mata contends is vital to safeguarding his privacy
interests is not important to those interests. Mata does not provide us with
an explanation.
As we understand Mata’s theory, provisions of the ALPR statute that if
violated would substantively infringe on his privacy interests would comprise
almost all the requirements of the ALPR statute, including: (1) maintain
reasonable security procedures and practices (§ 1798.90.51, subd. (a));
(2) implement a compliant usage and privacy policy (id., subd. (b)(1));
(3) make the usage and privacy policy available to the public, including by
posting it conspicuously on the operator’s website (ibid.); (4) maintain a
record of access to its ALPR information (§ 1798.90.52, subd. (a)); and
(5) restrict use of its ALPR information to the authorized purposes described
in the usage and privacy policy (id., subd. (b)). He argues these “specific
provisions . . . that DRN is alleged to have violated seek to ensure that the
implementation and operation of an ALPR system is ‘consistent with respect
for individuals’ privacy and civil liberties.” In Mata’s view, “[i]t makes little
sense to think that the Legislature elevated these specific values in the text
of the law but permitted suit only for a much narrower class of injuries, when
there is no textual indication of such a limit.” But as we have explained,
there are textual indications of such a limit to standing under the ALPR
statute.
Distilled to its core, there is not much daylight between Mata’s theory
of harm and the one we (and other courts) have already rejected—that “harm
results from any violation.” (Bartholomew, supra, 118 Cal.App.5th at p. 447;
24
see also Navarro, supra, 2022 WL 18280359, at p. *6 [requiring “plaintiffs to
show actual harm and a knowing violation,” italics added].)
C. The Undisputed Facts Show That Mata Has Not Been Harmed by Any
Alleged Violation
Apart from his theory of harm we have rejected, Mata makes no
attempt to show he has been harmed by any of DRN’s alleged violations. On
this record, we conclude there is no triable issue of material fact that Mata
suffered harm within the meaning of the ALPR statute. Mata’s ALPR
information in DRN’s system has never been the subject of a data security
breach or unauthorized access or use. In his own words, “the harm of mine,
. . . is the privacy has been—my privacy has been violated,” by the collection
and storage of ALPR information that is permitted under the statute. (Italics
added.)
The fear is understandable. As one court put it, “[l]icense plates are
publicly visible on cars, making it likely that they are captured numerous
times per day by stoplights, camera-wielding pedestrians, and security
cameras. Relatedly—and perhaps regrettably—life in the twenty-first
century is defined by an ever-increasing amount of digital surveillance.”
(Navarro, supra, 2022 WL 18280359, at p. *6.) Mata’s subjective belief of
harm, however, is not a cognizable harm for standing under the ALPR
statute. Thus, while he contends that there is a factual dispute about
whether DRN’s usage and privacy policy is adequate, whether that policy is
sufficiently conspicuous on DRN’s website, and whether DRN’s security
procedures and practices are sufficient, Mata has not identified how he has
been directly harmed by those alleged violations.
Mata contends we should rely on Bartholomew to conclude he has been
harmed within the meaning of the ALPR statute. In Bartholomew, the ALPR
25
operator, a parking garage owner and operator, had collected the plaintiff’s
ALPR information upon the plaintiff’s entry and exit from the garage.
(Bartholomew, supra, 118 Cal.App.5th at pp. 442, 445–446.) The ALPR
operator had not implemented, or made available to the public, any usage
and privacy policy, in violation of section 1798.90.51, subdivision (b)(1).
(Bartholomew, at p. 445.) The court rejected the plaintiff’s argument “that
harm results from any violation of the ALPR Law” and held that standing
“require[s] harm beyond a mere statutory violation.” (Id. at p. 447, italics
added.) As noted, we agree with Bartholomew on these points.
We are less sure, however, of Bartholomew’s final conclusion that the
plaintiff nonetheless had standing to sue based solely on the ALPR operator’s
specific statutory violation. (Bartholomew, supra, 118 Cal.App.5th at
pp. 448–451.) The court acknowledged the specified examples of “harm-
causing violations,” unauthorized access or use of ALPR information or
breach of an ALPR system’s security, “represent scenarios in which
information was in fact affirmatively misused or mishandled, suggesting
support for so limiting the requisite harm.” (Id. at p. 449.)
But the court determined the requirement of a usage and privacy policy
was a “significant end in itself, designed to ensure individuals know how
their data is being used and to help protect their privacy interests.”
(Bartholomew, supra, 118 Cal.App.5th at p. 451.) In this way, the court
reasoned, the ALPR statute “grants individuals the right to know which
entities are collecting their ALPR data and how it is being used and
maintained,” and the collection and storage of that data “without
implementing and making public the statutorily required policy harms these
individuals by violating this right to know.” (Id. at p. 449.) It so harms a
person whose ALPR information has been collected because that person
26
would have “more difficul[ty]” holding an ALPR operator accountable for
unauthorized use of that information, which is one of the specified examples
of a harm-causing violation. (Id. at p. 450.)
Although we are skeptical of this “right to know” harm, 17 we need not
resolve our concerns at this juncture. The Bartholomew court explicitly
acknowledged the limits of its own holding. In a footnote, the court stated,
“We express no opinion as to whether collecting and maintaining ALPR
information with a usage and privacy policy that does not include every
component identified in section 1798.90.51, subdivision (b)(2) would also
cause such harm.” (Bartholomew, supra, 118 Cal.App.5th at p. 449, fn. 10.)
Here, there is no dispute DRN implemented and made publicly available a
usage and privacy policy. Mata’s complaints about the alleged deficiency of
DRN’s policy is not that it fails to contain the information required by section
1798.90.51, subdivision (b)(1), but that DRN has implemented the policy only
“to maintain the appearance of adhering” to the law. In other words, he
contends DRN does not really mean what it says in the policy. We are
dubious that insincerity constitutes a violation where there is nonetheless
actual and literal compliance with the ALPR statute. Further, although he
contends the hyperlinked policy is not posted conspicuously, Mata concedes
he has never gone to DRN’s website to look for, let alone review, DRN’s usage
and privacy policy. He has, instead, only read the policy as part of the
documents provided to him by his attorneys during litigation. Even under
the rationale of Bartholomew’s “right to know” harm, none of these alleged
deficiencies show that Mata’s “right to know” has been harmed.
17 At oral argument, even counsel for Mata conceded the primary right
conferred by the ALPR statute is not a “right to know” but, as he has urged
all along, a right to privacy.
27
D. Conclusion
Based on the foregoing, we conclude the trial court properly granted
summary judgment in favor of DRN because Mata was not “harmed by a
violation of the statute” and thus did not have standing to pursue his lawsuit.
(§ 1798.90.54(a).)
II.
Aker Fails to Demonstrate Reversible Error by the Trial Court’s Denial of His
Ex Parte Application for Leave to Intervene
The trial court denied class member Aker’s ex parte application for
leave to intervene as a named plaintiff to substitute as class representative.
Aker appeals this order. Because Aker has failed to address all bases for the
trial court’s ruling, we conclude he has forfeited any challenge to the court’s
denial of his ex parte application.
The trial court issued its order granting summary judgment on May 7,
2024. In response to class counsel’s request, the court stayed the order and
any eventual entry of judgment “for a period of sixty (60) days” to allow class
counsel “to file a motion to substitute a new class representative into this
action.” The court also continued the “trial and related dates” by the same
period of sixty (60) days “to accommodate the expected [m]otion regarding the
substitution.”
On June 11, 2024, class counsel filed an ex parte application for an
order to extend the deadline to file a motion to substitute a new plaintiff and
the stay on entry of the order granting summary judgment “by 90 days to
October 7, 2024,” citing the need for discovery. The trial court denied this
request on June 17, finding no good cause to necessitate further delay. The
court vacated all dates and ordered DRN to submit a proposed judgment,
which it did on June 28.
28
On July 1, 2024, Aker sought leave to intervene as substitute class
representative on an ex parte basis. Aker alleged he would have standing to
sue DRN for an ALPR violation because he had reason to believe DRN had
disclosed his ALPR information to his automobile insurance company. He
formed this belief because, on two occasions between 2018 and 2019, his
automobile insurance company sent him a form asking him to verify where
one of his vehicles was garaged at night. He did not state that any adverse
consequences flowed from the insurance company’s inquiries. DRN opposed,
arguing among other things that the trial court had already denied the
previous ex parte application to extend time, and that an ex parte application
was not the correct procedural method to obtain leave to intervene as a
substitute class representative.
After a hearing on July 3, 2024 and taking the matter under
submission, the trial court denied Aker’s ex parte application on July 12, one
day after it entered judgment for DRN on July 11. The court gave two
independent reasons for its ruling. First, the court explained it had stayed
judgment for a period of 60 days and “[t]his 60-day period has now elapsed
such that any motion to intervene is too late.” Second, the court determined
it would be futile to allow Aker to intervene because, like Mata, he lacked
standing due to the absence of any “injury . . . sustained as a result of the
insurance company query.”
In his opening appellate brief, Aker challenges only one of these
grounds, namely, the futility of allowing him to intervene. Aker argues that
ruling was erroneous because he should be able to establish standing by
showing that “his ALPR data has been disclosed without his knowledge or
consent.” His opening appellate brief makes no mention of the alternative,
29
independent ground for the trial court’s ruling, that “any motion to intervene
is too late.” This is fatal to his appeal.
“It is a fundamental principle of appellate procedure that a trial court
judgment is ordinarily presumed to be correct and the burden is on an
appellant to demonstrate, on the basis of the record presented to the
appellate court, that the trial court committed an error that justifies reversal
of the judgment.” (Jameson v. Desta (2018) 5 Cal.5th 594, 608–609.) In
addressing only one of the trial court’s two independent grounds for denying
his ex parte application, Aker has failed to meet his appellate burden to show
the court committed reversible error. “When a trial court states multiple
grounds for its ruling and appellant addresses only some of them, we need
not address appellant’s arguments because ‘one good reason is sufficient to
sustain the order from which the appeal was taken.’ ” (People v. JTH Tax,
Inc. (2013) 212 Cal.App.4th 1219, 1237.) If a trial court gives an independent
basis for its ruling, a party’s “failure to discuss it forfeits its challenge to the
ruling.” (Briley v. City of West Covina (2021) 66 Cal.App.5th 119, 133
(Briley).)
For the first time in his reply brief, Aker explains he did not address
the part of the trial court’s statement that “any motion to intervene is too
late” because he does not believe the court intended that statement as one of
the reasons it was denying the ex parte application. Specifically, according to
Aker, “that statement could not have referred to [him], since his motion came
within the 60-day period.” We are not persuaded.
The trial court’s July 12, 2024 minute order stated: “The Court’s
May 7, 2024 Minute Order stayed judgment for a period of 60 days. This 60-
day period has now elapsed such that any motion to intervene is too late.
Defendant [DRN] has the right to seek a final disposition of this action. [¶]
30
In addition, Mr. Aker’s intervention and substitution as a class
representative would be futile, and is denied on this basis as well.” (Italics
added.) Aker’s reading of the trial court’s statement is not plausible. The
only item that the trial court ruled upon in its July 12, 2024 minute order
was Aker’s ex parte application. And the italicized words— “[i]n addition”
and “as well”—make it clear its ruling denying his ex parte application rested
on two alternative and independent grounds.
Because Aker has failed to address both bases for the trial court’s
ruling, he has forfeited any challenge to the court’s denial of his ex parte
application. (Briley, supra, 66 Cal.App.5th at p. 133.)
DISPOSITION
We affirm the judgment, as well as the trial court’s July 12, 2024 order
denying Aker’s ex parte application for leave to intervene. DRN shall recover
its costs on appeal.
DO, J.
WE CONCUR:
McCONNELL, P. J.
RUBIN, J.
31