Flock, Your Number Plate, and the Art of the Corporate Shrug

I’ve been reading about a company called Flock Safety this week, an American outfit that runs automatic licence plate readers, and it’s put me in a bit of a mood. Not the theatrical kind. The quieter, more useful kind of annoyed that makes you want to actually think something through.

Here’s the setup. A Californian resident, using rights that California’s privacy law is supposed to give him, asked Flock for a record of everywhere his own number plate had been logged across their network. Flock said no. Not “here’s your data,” not even “give us a fortnight,” but a genuine, polished, legally worded no. Their reasoning: they’re just the technology provider. Their customers, which is to say the police departments, HOAs and private businesses who buy the cameras, are the ones who “own and control” the data. If you want your own information, Flock says, go and ask each of the six thousand-odd organisations that might have a camera pointed at a street you’ve driven down. Good luck with that.

I want to sit with how neat that trick is, because it’s not really about Flock. It’s a template. Build the infrastructure, host the data, set the defaults, write the contracts, and then when someone asks an inconvenient question, point at “the customer” and disappear behind the fine print. You get all the benefits of running the surveillance network and none of the accountability that’s supposed to come with holding people’s information. One commenter on the original thread put it about as well as anyone could: Flock’s own agreements apparently claim ownership over “derivative data,” which rather undercuts the whole “we’re just the plumbing” defence. You can’t have it both ways, except, it turns out, you absolutely can, if nobody’s forcing you not to.

I don’t have a Flock camera anywhere near my street that I know of, and this is an American company operating under American law, so it’s tempting to file this under “not my problem, interesting overseas story.” I’d resist that. We’ve got our own version of this creeping in, quietly, through toll road operators, shopping centre car parks, council parking apps, and a rapidly growing number of private security firms who’d love nothing more than a network of cameras and a database nobody can meaningfully audit. Melbourne’s already reasonably well covered with number plate recognition on the freeways, ostensibly for toll enforcement and traffic management. Nobody voted on that specifically. It just arrived, sold as convenience and safety, the way most surveillance infrastructure does.

What gets me is the asymmetry. Getting a plate scanned takes a fraction of a second and happens automatically, thousands of times, without you doing anything at all. Getting your own data back out of the system that scanned you requires filing formal requests, citing specific legislation, and then, apparently, being told to go bother the local pub or the neighbourhood HOA individually. The friction is entirely one directional. It’s cheap to collect and expensive to reclaim, and that imbalance is the whole business model, not a bug in it.

I don’t think the answer is “ban all cameras,” and I’ll be honest about the tension there, because some of this technology genuinely does help find stolen cars and missing kids, and I’m not going to pretend that doesn’t matter. But there’s a difference between a tool used for a specific, warranted purpose and a permanent, searchable record of where every car in a region has been, sitting in a private company’s servers with no meaningful right of access for the person it’s about. Those are not the same conversation, and companies like Flock have a strong incentive to keep them blurred.

If there’s a hopeful thread in any of this, it’s that people are still filing the requests, still writing to their state attorneys-general, still making enough noise that a company has to produce a carefully lawyered non-answer instead of just ignoring the question. That’s not nothing. It’s slow, and it’s exhausting, and it shouldn’t fall entirely on individuals to chase down data about themselves that was collected without their say-so in the first place. But every time someone asks “where’s my information and who’s looking at it,” it gets a little harder for the answer to be “not your business, mate.” I’d rather have that fight than not have it at all.