Mata v. Digital Recognition Network, Inc.

Filed 7/20/26 CERTIFIED FOR PUBLICATION COURT OF APPEAL, FOURTH APPELLATE DISTRICT DIVISION ONE STATE OF CALIFORNIA GUILLERMO MATA, D084781 Plaintiff and Appellant, v. (Super. Ct. No. 37-2021- 00023321-CU-MC-CTL) DIGITAL RECOGNITION NETWORK, INC., Defendant and Respondent; SCOTT AKER, Movant and Appellant. APPEALS from a judgment and an order of the Superior Court of San Diego County, Joel R. Wohlfeil, Judge. Affirmed. Edelson and J. Aaron Lawson for Plaintiff and Appellant and Movant and Appellant. Matthew T. Cagle, Jacob A. Snow; Juelsgaard Intellectual Property and Innovation Clinic, Mills Legal Clinic at Stanford Law School, Phillip R. Malone, Nina K. Srejovic; and Nicole A. Ozer for the American Civil Liberties Union of Northern California, the American Civil Liberties Union of Southern California, the American Civil Liberties Union of San Diego and Imperial Counties, the Center for Constitutional Democracy and the Electronic Frontier Foundation as Amici Curiae on behalf of Plaintiff and Appellant. Kilpatrick Townsend & Stockton, Nancy L. Stagg, Xiao Jing Diego Wu Min, Cole B. Ramey, Timothy E. Taylor and John D. Robinson for Defendant and Respondent. INTRODUCTION California’s Automated License Plate Recognition (ALPR) statute requires public and private ALPR operators and end-users to implement certain procedural safeguards regarding the collection and storage of ALPR information. (Civ. Code, 1 § 1798.90.5 et seq.) “[A]n individual who has been harmed by a violation” of the statute is authorized to bring a civil action against “a person who knowingly caused the harm.” (§ 1798.90.54, subds. (a) & (b), italics added.) The question presented in this appeal is whether a person, like Guillermo Mata, who alleges a violation of the ALPR statute but identifies no resulting harm—other than his own subjective belief that his privacy has been invaded by the collection and storage of his data—has standing to sue under the ALPR statute. We conclude the answer is no. Based on the plain text, standing under the ALPR statute requires actual harm. For this reason, we affirm the trial court’s grant of summary judgment in favor of Digital Recognition Network, Inc. (DRN) on the basis that Mata, as class representative, lacked standing under the ALPR statute. We also affirm the trial court’s order denying class member Scott Aker leave to intervene as a named plaintiff on the basis he has forfeited any challenge to the order. 1 All further undesignated statutory references are to the Civil Code. 2  BACKGROUND I. The ALPR Statute Enacted in 2015, the ALPR statute (Stats. 2015, ch. 532, § 3, eff. Jan. 1, 2016) regulates both public agencies and private entities in the operation and use of an “ ‘ALPR system,’ ” which is defined as “a searchable computerized database resulting from the operation of one or more mobile or fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer-readable data.” (§ 1798.90.5, subd. (d); see §§ 1798.90.51, 1798.90.53, 1798.90.55.) It sets forth certain requirements that an “ ‘ALPR operator’ ” must follow. 2 First, ALPR operators must “[m]aintain reasonable security procedures and practices, including operational, administrative, technical, and physical safeguards, to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.” 3 (§ 1798.90.51, subd. (a).) Second, ALPR operators must “[i]mplement a usage and privacy policy in order to ensure that the collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties.” (§ 1798.90.51, subd. (b)(1).) The usage and privacy policy must be made available to the public in writing and be “posted conspicuously” on any website maintained by the operator. (Ibid.) 2 An “ ‘ALPR operator’ ” is “a person that operates an ALPR system, but does not include a transportation agency when subject to Section 31490 of the Streets and Highways Code.” (§ 1798.90.5, subd. (c).) 3 “ ‘ALPR information’ means information or data collected through the use of an ALPR system.” (§ 1798.90.5, subd. (b).) 3 Additionally, the usage and privacy policy “shall, at a minimum,” include the following seven items of information: “(A) The authorized purposes for using the ALPR system and collecting ALPR information. “(B) A description of the job title or other designation of the employees and independent contractors who are authorized to use or access the ALPR system, or to collect ALPR information. The policy shall identify the training requirements necessary for those authorized employees and independent contractors. “(C) A description of how the ALPR system will be monitored to ensure the security of the information and compliance with applicable privacy laws. “(D) The purposes of, process for, and restrictions on, the sale, sharing, or transfer of ALPR information to other persons. “(E) The title of the official custodian, or owner, of the ALPR system responsible for implementing this section. “(F) A description of the reasonable measures that will be used to ensure the accuracy of ALPR information and correct data errors. “(G) The length of time ALPR information will be retained, and the process the ALPR operator will utilize to determine if and when to destroy retained ALPR information.” (§ 1798.90.51, subd. (b)(2)(A)–(G).) 4 Third and last, if an ALPR operator accesses or provides access to ALPR information, it must maintain a record of that access and require the 4 The ALPR statute similarly requires that an “ ‘ALPR end-user,’ ” generally defined as “a person that accesses or uses an ALPR system” (§ 1798.90.5, subd. (a)(1)–(3)), maintain reasonable security procedures and practices to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure (§ 1798.90.53, subd. (a)); and implement and make available a written usage and privacy policy to the public and post it conspicuously on the end-user’s website (§ 1798.90.53, subd. (b)(1)–(2)). 4 ALPR information only be used for the authorized purposes described in the usage and privacy policy. (§ 1798.90.52, subds. (a)–(b).) Significantly, the ALPR statute does not restrict or place limitations on a private entity’s collection or use of ALPR information. (See Bartholomew v. Parking Concepts, Inc. (2026) 118 Cal.App.5th 438, 449 (Bartholomew) [“the ALPR [statute] does not impose specific substantive requirements on private entities’ collection and use of ALPR data”].) 5 It does, however, impose restrictions on public agencies: a “public agency that operates or intends to operate an ALPR system shall provide an opportunity for public comment” at a public meeting before its implementation, and it “shall not sell, share, or transfer ALPR information, except to another public agency, and only as otherwise permitted by law.” 6 (§ 1798.90.55, subds. (a)–(b).) By contrast, the ALPR statute “vests private entities that collect and use ALPR information with wide leeway to determine what to do with this data.” (Bartholomew, at p. 449.) II. The ALPR Statute’s Private Right of Action The ALPR statute allows a private right of action under section 1798.90.54. It provides: “In addition to any other sanctions, penalties, or remedies provided by law, an individual who has been harmed by a violation of this title, including but not limited to, unauthorized access or use of ALPR 5 Bartholomew, supra, 118 Cal.App.5th 438, was decided while this appeal was pending. As such, we invited and considered the parties’ supplemental letter briefs addressing the impact of the decision in this case. 6 “ ‘Public agency’ means the state, any city, county, or city and county, or any agency or political subdivision [thereof], including, but not limited to, a law enforcement agency.” (§ 1798.90.5, subd. (f).) 5 information or a breach of security of an ALPR system, may bring a civil action in any court of competent jurisdiction against a person who knowingly caused the harm.” (§ 1798.90.54, subd. (a), italics added.) In such an action, the court may award any combination of actual damages, but not less than liquidated damages of $2,500, punitive damages upon proof of willful or reckless disregard of the law, reasonable attorney fees and costs, and other preliminary and equitable relief deemed appropriate. (§ 1798.90.54, subd. (b)(1)–(4).) III. DRN’s ALPR Business DRN is an “ALPR operator” within the meaning of the ALPR statute. 7 It “offers license plate recognition services to customers in the private sector.” It sells ALPR hardware, including mobile and fixed cameras that are mounted on vehicles like tow trucks or other physical infrastructure, with the integrated software to capture images of license plates on vehicles in areas visible to the public. DRN stores the original images from its cameras and their associated computer-readable data in an ALPR system that it owns and maintains. The information in DRN’s ALPR system includes images of license plates and vehicles, with the date, time, and location the images were captured, as well as the license plate characters and state captured from the images. In May 2024, DRN’s ALPR system contained “over 9 billion historical license plate images.” 7 Although Mata’s complaint alleged that DRN qualified as either an ALPR operator or ALPR end-user, Mata describes DRN solely as an ALPR operator in his appellate briefing. We thus omit any discussion of Mata’s allegations under section 1798.90.53, subdivision (b), which pertains to the regulation of an ALPR end-user. 6  The parties agree that, in late 2015, DRN adopted an ALPR usage and privacy policy (DRN’s policy) and did so “in a deliberate and conscious manner.” The policy was drafted by DRN’s founder and former executive chairman, Todd Hodnett, “who looked at the [ALPR] statute and drafted the [policy], and then obtained approval from his CEO, CTO, and outside counsel.” DRN’s policy includes the seven items of information required by the ALPR statute. (See § 1798.90.51, subd. (b)(2)(A)–(G).) The policy is hyperlinked at the bottom of the homepage of DRN’s website under the title “California ALPR policy.” DRN’s policy identifies three “authorized uses” of its ALPR system: by its “customers to identify or ascertain the location of a specific vehicle under circumstances when there is a legitimate commercial interest”; by “law enforcement agencies for law enforcement purposes”; and by DRN “to make [A]LPR data available to customers and law enforcement agencies for the purposes above, and to provide market research information to customers based on aggregated [A]LPR data.” (§ 1798.90.51, subd. (b)(2)(A).) It identifies its users and their training requirements, specifically providing that “[a]ll independent contractors of the company are authorized to use the ALPR system for purposes consistent with their underlying contract with the company and this policy.” (§ 1798.90.51, subd. (b)(2)(B).) In accord with that statement, DRN requires all third parties to execute a written contract in which the third party agrees to comply with all applicable laws, including state privacy laws, when accessing and using information stored in the ALPR system. Additionally, DRN’s policy describes its monitoring process to ensure security and compliance with applicable privacy laws, including conducting periodic audits of its usage logs. 7  IV. Mata’s Class Action Lawsuit In 2021, Mata filed a putative class action lawsuit against DRN on behalf of “[a]ll persons in the State of California whose license plate data was collected by [DRN] using an automatic license plate reader.” 8 The complaint contained a single cause of action: an asserted violation of the ALPR statute by DRN. Mata alleged that although DRN maintains a written privacy and usage policy on its website, it does so only “to maintain the appearance of adhering” to the ALPR statute and “to pay lip service to privacy laws without having any intention of actually complying with them.” Specifically, he alleged DRN violated section 1798.90.51, because it (1) “does not make a meaningful usage and/or privacy policy available to the public, nor does it conspicuously post any information about usage and/or privacy on its website”; (2) “does not implement a meaningful usage and privacy policy in order to ensure that its collection, use, maintenance, sharing, and dissemination of ALPR information is consistent with respect for individuals’ privacy and civil liberties”; and (3) “expressly disclaims the highly sensitive nature and serious privacy implications of its ALPR data, and as a result fails to conduct the security procedures and practices reasonably necessary to protect such sensitive information from unauthorized access, destruction, use, modification, or disclosure.” He further alleged DRN violated section 1798.90.52, subdivision (b), because “it allows, and indeed encourages its 8 The complaint, along with other documents that were filed in the trial court but omitted from the clerk’s transcript, is one of the exhibits submitted by DRN in an unopposed motion to augment the appellate record, filed on August 21, 2025. We hereby grant DRN’s motion to augment. 8 customers to use its ALPR system for the unauthorized purpose of tracking and locating individuals.” As for harm, Mata asserted that “[he] and the Class have been harmed by [DRN’s] conduct because their private and sensitive personal information has been improperly collected and used without their notice or consent.” (Italics added.) Mata further asserted he is “one of millions of individuals who has fallen victim to DRN’s pervasive surveillance network,” as it has “tracked Mata’s vehicle, thus gaining access to his home and work address and other sensitive information such as the time he typically leaves and comes home and where he likes to spend his free time.” His complaint states, “This lawsuit seeks to put an end to DRN’s portentous surveillance tactics and to hold the company accountable for disparaging the privacy rights of California citizens.” V. The Trial Court Grants DRN Summary Judgment DRN moved for summary judgment on two grounds: Mata lacked standing to bring a civil action under the ALPR statute because he had not been harmed by any alleged violation, and there was no evidence that DRN had violated the ALPR statute. The trial court agreed that Mata lacked standing and granted summary judgment for DRN on that basis. It did not reach DRN’s second argument. 9 9 Before its motion for summary judgment, DRN had removed the action to federal district court based on diversity jurisdiction. The district court remanded the action back to the superior court, concluding that it lacked subject matter jurisdiction because Mata failed to allege injury in fact to satisfy standing under Article III of the United States Constitution. (Mata v. Digital Recognition Network, Inc. (S.D. Cal., May 6, 2022, No. 21-CV-1485 JLS (BLM)) 2022 WL 1445225; see also Mata v. Digital Recognition Network, 9  In support of its showing that Mata lacked standing 10 DRN argued Mata’s involvement in the lawsuit “does not arise out of any specific event or injury he has suffered” and produced the following evidence. In his deposition, Mata testified his ALPR information in DRN’s system has never been the subject of a data security breach or unauthorized access or use. He has not had his identity stolen, never been stalked, has not suffered any physical injury or harm, has not lost any wages or suffered any monetary damage because of any conduct by DRN. When asked if DRN’s conduct caused him to suffer any mental anguish, Mata testified: “[M]y privacy is something that I think—privacy I think is something a lot of other people will agree that it’s very personal to them. [¶] And for myself, my privacy is very important. I hold it to high—I think a lot of people take a lot of precautions to protect their privacy. So for me, my harm—the harm of mine, and I’m sure a lot of others would agree, is the privacy has been—my privacy has been violated on multiple occasions.” (Italics added.) Inc. (S.D. Cal., Mar. 25, 2022, No. 21-CV-1485 JLS (BLM)) 2022 WL 891433 [explaining that Mata had not adequately alleged standing, as he failed to identify any injury in fact].) After remand, DRN filed an answer and the trial court certified the class, defined as “[a]ll residents of California whose California license plate data was collected by [DRN] (either directly or through an affiliate) in the State of California at least fifteen times between June of 2017 and the date of final judgment.” 10 In support of DRN’s alternative argument that summary judgment was proper because the undisputed evidence established it did not violate the ALPR statute, DRN produced evidence of its security protocols; its usage and privacy policy, which is available on its website; and its contracts and requirements for its customers. We previously summarized this evidence in the Background, section III. 10  Mata testified he decided to file this lawsuit when he learned about ALPR technology in something he read. In his words, “One day, . . . I was at home and it came across to me, I mean, I think it was some kind of—I forgot what it was. It was maybe like an article or something talking about how companies are retrieving customer’s data. And I felt like that—that applied to me, so, . . . not being an attorney, I didn’t know if it did or not. So that’s when I reached out to my—to my attorney to just let them know, hey, this is what I think, and then I let them decide from there.” Although ALPR information for his vehicles had been collected by DRN—the license plates for Mata’s two vehicles have each been captured at least 15 times and appear in DRN’s ALPR system—Mata conceded his data has only been accessed by his own attorneys, with his express authorization, for this litigation. He also has never gone to DRN’s website to review DRN’s usage and privacy policy, but has read it only “as part of the preparation for the documents that [his] attorneys prepared.” In opposition, Mata did not refute DRN’s evidence that he had not suffered any direct harm because of DRN’s conduct, such as unauthorized access or use of his ALPR information. 11 But in his view, “[t]he ALPR statute is designed to protect [individual] privacy, and presumes that invasions of privacy are harmful.” And any infringement of that “statutory right” constitutes actionable harm. He asserted DRN violated his and class members’ privacy rights by collecting “at least 15 license plate scans of every 11 Mata argued DRN was aware of “credential sharing,” which “is when users share their login information with other people” and enables others to gain unauthorized access to ALPR information, but failed to take reasonable steps to prevent it. Although he argued credential sharing is “a form of unauthorized access,” Mata did not produce any evidence of an actual occurrence of this with his own ALPR information. 11 Class member,” while maintaining “a meaningless, non-compliant usage and privacy policy, failing to enact reasonable data security protocols, and failing to provide adequate notice to the public,” in violation of the ALPR statute. The trial court did not agree with Mata’s theory of harm and granted summary judgment in favor of DRN. Among other things, the court found the undisputed evidence showed Mata had not sustained any physical, mental or monetary injury due to DRN’s collection of ALPR data, and Mata’s ALPR information has never been disclosed or accessed by anyone without his consent. Construing the ALPR statute to require harm that is “the result of some action which causes injury stemming from improper access or use of ALPR data,” the court concluded there was no triable issue that Mata lacked standing. DISCUSSION I. Summary Judgment Was Proper Because Mata Lacks Standing Appealing the judgment, Mata contends the trial court erred in its interpretation of the ALPR statute’s standing requirement and summary judgment should not have been granted. We review the trial court’s summary judgment order and questions of statutory interpretation de novo. (Olson v. La Jolla Neurological Associates (2022) 85 Cal.App.5th 723, 733 [summary judgment]; Bruns v. E-Commerce Exchange, Inc. (2011) 51 Cal.4th 717, 724 (Bruns) [statutory interpretation].) On our de novo review, we find no error. A. The Parties’ Competing Theories of Harm Under the ALPR statute, “an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system, may bring a 12 civil action . . . against a person who knowingly caused the harm.” (§ 1798.90.54, subd. (a), italics added.) Mata’s standing turns on whether he has been “harmed by a violation” of the ALPR statute. The parties offer competing responses. The relevant facts are not disputed. Mata’s ALPR information stored in DRN’s system has never been the subject of unauthorized access or use, or a data security breach. His ALPR information has not been accessed by anyone except his own attorneys, with his authorization, in connection with his lawsuit. He has not experienced any physical or monetary injury. Based on these undisputed facts, DRN contends Mata has not been harmed within the meaning of the ALPR statute. In DRN’s view, the “harm” which must be shown to confer standing is actual harm. Mata, in contrast, sets forth a broad theory of harm that he calls a “collection-based invasion of privacy” harm. 12 He explains his theory as follows: California recognizes “an invasion of privacy as itself harmful, without the need to examine any consequences flowing from the invasion.” Specifically, the “collection and retention of information about an individual, by itself, threatens” this individual privacy interest. “Because DRN has collected massive amounts of data about Mr. Mata, as well as every other member of the class, they have intruded on [this] well-recognized privacy 12 Mata’s complaint asserted an even broader theory of harm, under which the mere collection and use of ALPR information without his notice or consent constitutes harm. This is not a viable theory because the ALPR statute does not require an ALPR operator (or end-user) to provide notice or obtain consent for the collection and use of ALPR information, nor does it restrict or place any substantive limitations on a private entity’s collection or use of ALPR information. (See Bartholomew, supra, 118 Cal.App.5th at p. 449.) 13 interest.” “Having undertaken to do so, unless DRN’s collection of this data comports with, and respects, Mr. Mata’s privacy interests and civil liberties, . . . Mr. Mata can plausibly claim to have been ‘harmed’ by DRN’s actions.” Put another way by Mata, “the collection of a sufficient number of scans to reveal sensitive details about one’s life, and the storage of that data indefinitely in a database that is not secured in the manner required by California law, both because the database operator lacks a statutorily compliant [usage and privacy] policy and has failed to implement necessary security measures, is an actionable harm.” (Italics added.) He adds, however, that he makes “no argument that any violation of the ALPR law, no matter how technical, invades the privacy of those whose data has been collected.” 13 As we understand Mata’s theory, the harm sufficient to confer standing is the invasion of his privacy that results from the very collection and retention of ALPR information that is permitted by the statute, so long as the ALPR operator is out of compliance with a nontechnical provision of the statute. We find no support for this theory in the text or the legislative history of the ALPR statute, and conclude standing requires actual harm by the violation. B. Standing Under the ALPR Statute Requires Actual Harm “Standing rules for actions based upon statute may vary according to the intent of the Legislature and the purpose of the enactment.” (Angelucci v. 13 As Mata explained in his opposition to DRN’s motion for summary judgment, “Some violations may not cause privacy harm in themselves, like if an ALPR operator’s policy fails to identify ‘[t]he title of the official custodian, or owner, of the ALPR system responsible for implementing this section,’ ” quoting section 1798.90.51, subdivision (b)(2)(E). 14 Century Supper Club (2007) 41 Cal.4th 160, 175.) Thus, where a cause of action is based on a California statute, standing is “a matter of statutory interpretation.” (Adolph v. Uber Technologies Inc. (2023) 14 Cal.5th 1104, 1120.) Our fundamental task in construing a statute is “ ‘to determine and give effect to the intent of the enacting legislative body.’ ” (Holland v. Assessment Appeals Bd. No. 1 (2014) 58 Cal.4th 482, 490.) We begin by looking at the language of the statute because it is generally the most reliable indicator of legislative intent, and we give it a plain and commonsense meaning. (Ibid.) We do not examine that language in isolation, but in the context of the entire statutory framework. (Bruns, supra, 51 Cal.4th at p. 724.) “[W]e must follow the fundamental rule of statutory construction that requires every part of a statute be presumed to have some effect and not be treated as meaningless unless absolutely necessary. ‘Significance should be given, if possible, to every word of an act. . . . Conversely, a construction that renders a word surplusage should be avoided.’ ” (People v. Arias (2008) 45 Cal.4th 169, 180 (Arias).) “ ‘If the language is clear in context, our work is at an end. If it is not, we may consider other aids, including the statute’s legislative history.’ ” (City of Gilroy v. Superior Court (2026) 19 Cal.5th 38, 51.) 1. Statutory Text Turning first to the plain text of the provision that authorizes a private right of action—section 1798.90.54, subdivision (a) (hereafter § 1798.90.54(a))—we find several items significant to our construction of the words, “harmed by a violation.” First, section 1798.90.54(a) differentiates between the concept of harm, on the one hand, and the concept of a statutory violation, on the other. 15 Specifically, an individual may bring suit if “harmed by a violation.” (§ 1798.90.54(a), italics added). “When the Legislature uses different words as part of the same statutory scheme, those words are presumed to have different meanings.” (Romano v. Mercury Ins. Co. (2005) 128 Cal.App.4th 1333, 1343.) In choosing to make the violation itself distinct from the harm that the violation causes, the Legislature requires both to be shown. Thus, more than a mere statutory violation is required to confer standing to bring suit. On this point, we agree with the court in Bartholomew, supra, 118 Cal.App.5th 438, when it rejected the plaintiff’s argument “that harm results from any violation” of the ALPR statute.” (Id. at p. 447 [“The statutory language limiting civil actions to persons ‘harmed by a violation’ against defendants who ‘caused the harm’ indicates that more than just the fact of a violation is required.”].) As the Bartholomew court observed, “[i]n contrast, other statutes contain language expressly imposing liability for ‘violations.’ For example, the Fair Debt Buying Practices Act (§ 1788.50 et seq.) provides, ‘[A] debt buyer that violates any provision of this title with respect to any person shall be liable to that person’ for actual or statutory damages.” (Bartholomew, supra, 118 Cal.App.5th at p. 447, quoting § 1788.62, subd. (a) and citing Chai v. Velocity Investments, LLC (2025) 108 Cal.App.5th 1030, 1040 (Chai); see also Parsonage v. Wal-Mart Inc. (2026) 118 Cal.App.5th 399, 406, 420–421 [holding no showing of injury required under provision of the Investigative Consumer Reporting Agencies Act (§ 1786 et seq.) that makes an employer who “fails to comply with any requirement” of the statute liable to consumers; collecting cases construing other statutes containing language expressly imposing liability for violations].) These statutes demonstrate that the Legislature knows how to create a statutory right and “deem a violation of 16 that right an injury sufficient to confer standing.” (Chai, at p. 1040.) The Legislature did not do that with the ALPR statute. Further still, section 1798.90.54(a), gives several non-exclusive examples of how a plaintiff might be harmed by a statutory violation. It authorizes suit by “an individual who has been harmed by a violation of this title, including, but not limited to, unauthorized access or use of ALPR information or a breach of security of an ALPR system.” (§ 1798.90.54(a), italics added.) The “inclusion of [several] examples of harm-causing violations indicates that more than just a violation is required, as there would be no need to provide examples if any violation was sufficient.” (Bartholomew, supra, 118 Cal.App.5th at p. 447.) Second, the preposition “by” in the phrase, “harmed by a violation” is used to connect “harmed” and “violation.” (§ 1798.90.54(a), italics added.) Giving the word its usual meaning and effect, “by” explains what caused the person to be harmed and means “as a result of” or “because of” the violation. (People v. Cole (2004) 33 Cal.4th 1158, 1208 [“The preposition ‘by,’ in itself, commonly signifies a causal connection.”].) The harm then must arise from the violation. Third, we turn to the dictionary definition of “harm.” As noted by the district court in Navarro v. Skidata, Inc. (C.D. Cal., Dec. 7, 2022, No. 2:20- CV-07370-SVW-SK) 2022 WL 18280359 (Navarro)), “[t]he ordinary meaning of harm, according to the Merriam-Webster Dictionary, is ‘physical or mental damage; injury.’ Black’s Law Dictionary is in accord, defining harm as ‘injury, loss, damage; material or tangible detriment.’ ” (Id. at p. *5.) From the plain meaning of “harm,” among other reasons, the district court 17 concluded “actual harm is required to establish a violation of the California ALPR statute.” 14 (Id. at pp. *5–*6) Here we note the ALPR statute does not require a plaintiff to suffer measurable monetary damages to establish harm. (See Bartholomew, supra, 118 Cal.App.5th at p. 447.) It allows recovery of actual damages or the statutory minimum of $2,500 as liquidated damages. (§ 1798.90.54, subd. (b)(1).) We agree with Mata that the Legislature’s inclusion of statutory damages evinces the Legislature’s intention to allow a plaintiff to recover for “difficult to quantify” harm. But it does not follow, as Mata contends, that it signals the Legislature’s intention to authorize an individual to bring suit based on the type of amorphous harm he has articulated. Fourth, the Legislature provides three specific examples of how an individual may be harmed by a violation of the ALPR statute: (1) unauthorized access of ALPR information, (2) unauthorized use of ALPR information, and (3) breach of security of an ALPR system. (§ 1798.90.54(a).) All three are examples of actual, not abstract, harm. The interpretive canon of ejusdem generis, meaning “of the same kind,” applies here. (Brown v. City 14 In Navarro, after discovering that ALPR technology was being used in shopping mall parking lots, plaintiffs sued the shopping malls and the manufacturers of the ALPR technology, alleging, among other things a violation of the ALPR statute. (Navarro, supra, 2022 WL 18280359, at pp. *1–*2.) The district court concluded that “actual harm” was required for the plaintiffs to have standing under the ALPR statute (id. at p. *6), but that plaintiffs had failed “to demonstrate actual harm that was caused by any particular defendant” since “[n]othing in the record, for instance, shows that any [d]efendant’s improper handling of data led to its misuse that could in turn justifiably spark [p]laintiffs’ allegations of ‘identity theft,’ apparent discovery of data on the ‘dark web,’ acquisition of credit monitoring services, emotional distress, or diminution in value of personally identifying information.” (Id. at p. *8.) 18 of Inglewood (2025) 18 Cal.5th 33, 43 (Brown).) “The canon, which ‘ “ ‘applies whether specific words follow general words in a statute or vice versa,’ ” ’ instructs that ‘ “the general term or category is ‘restricted to those things that are similar to those which are enumerated specifically.’ ” ’ ” (Ibid.) Important here, the interpretive canon of ejusdem generis applies even where the specifically enumerated items of the statute are preceded by the words “including, but not limited to.” (Brown, supra, 18 Cal.5th at p. 43.) And although Mata is correct that the words “including, but not limited to” are “a phrase of enlargement,” it is “not necessarily a phrase without limits.” (Ibid.) The phrase “must be read in conjunction with the examples the statute sets forth” and while the phrase connotes an illustrative listing, “ ‘the specific examples’ listed may restrict the meaning of the defined term.” (Ibid.) Contrary to Mata’s argument, ejusdem generis “does not allow us to ignore the restrictions the Legislature set or to broaden the meaning of [the term to be interpreted] beyond the restrictions set forth in the Legislature’s . . . example[s].” (Arias, supra, 45 Cal.4th at p. 180.) “The rule is ‘based on the obvious reason that if the Legislature had intended the general words to be used in their unrestricted sense, it would not have mentioned the particular things or classes of things which would in that event become mere surplusage.’ ” (Ibid.) In sum, giving effect “to every word” in section 1798.90.54(a), we conclude standing under the ALPR statute requires that a plaintiff must demonstrate actual harm that arises from the violation. (Arias, supra, 45 Cal.4th at p. 180 [“Significance should be given, if possible, to every word of an act.”].) 19  2. Legislative History We have reviewed the legislative history, but we do not find that it provides any further clarity as to the meaning of “harmed by a violation” beyond the statutory text we have just discussed. However, the limited information that we have gleaned is consistent with our construction of the statute. 15 The ALPR statute was enacted by Senate Bill No. 34 in 2015. (Stats. 2015, ch. 532, § 3.) None of the committee reports or analyses for Senate Bill No. 34 discuss the meaning of the requirement that, to file a lawsuit, an individual must be “harmed by a violation” of the statute. (§ 1798.90.54(a).) We also do not find the amendments made to the statutory language as it proceeded through the Legislature to be particularly instructive on that question. 16 (See Kaufman & Broad Communities, Inc. v. Performance 15 Mata’s discussion of the legislative history is mostly focused on establishing that the Legislature viewed ALPR information as implicating the public’s privacy interests, at least to some extent. Our review of legislative history here has a more specific focus. Namely, we review the legislative history to determine whether it sheds any light on what the Legislature meant by “an individual who has been harmed by a violation” of the statute. (§ 1798.90.54(a).) 16 In interpreting the private cause of action provision in the ALPR statute, the district court in Navarro, supra, 2022 WL 18280359 at page *6, focused on an amendment to Senate Bill No. 34, in which the phrase allowing a lawsuit “against a person who knowingly caused that violation” was changed to a phrase allowing a lawsuit “against a person who knowingly caused the harm.” (Legis. Counsel’s Dig., Sen. Bill No. 34 (2015–2016 Reg. Sess.) p. 15, as amended July 2, 2015, italics added.) Bartholomew also found this amendment to be significant. (Bartholomew, supra, 118 Cal.App.5th at pp. 447–448.) In our view, however, that language serves only to describe the class of defendants who may be sued, not the class of plaintiffs who may sue. 20 Plastering, Inc. (2005) 133 Cal.App.4th 26, 31 [a court may consider different versions of the bill as part of a legislative history analysis].) However, two enrolled bill reports sent to the Governor provide some relevant statements. “Enrolled bill reports are legislative history that may be considered by courts in construing a statute.” (People v. Adir International, LLC (2025) 114 Cal.App.5th 275, 324; see also Elsner v. Uveges (2004) 34 Cal.4th 915, 934, fn. 19 [“we have routinely found enrolled bill reports, prepared by a responsible agency contemporaneous with passage and before signing, instructive on matters of legislative intent”].) First, an enrolled bill report from the Department of Finance explains that “[p]otential costs at the local level may arise from the following requirements of this bill: . . . Damages resulting from civil actions brought by individuals who have been harmed by improper use of [ALPR] system data.” (Dept. of Finance, Enrolled Bill Mem. to Governor on Sen. Bill No. 34 (2015– 2016 Reg. Sess.) Sept. 10, 2015, p. 1, italics added.) Second, an enrolled bill report from the California Highway Patrol states, “[Senate Bill No.] 34 would permit anyone whose information is disclosed in violation of the sections proposed by this bill to seek civil action against the individual who knowingly caused the violation.” (Cal. Highway Patrol, Enrolled Bill Rep. on Sen. Bill No. 34 (2015–2016 Reg. Sess.) Sept. 1, 2015, p. 1, italics added.) That same report describes the following argument in favor of the bill: “This bill outlines rules and regulations regarding the use of personal information and the consequences for allowing that personal information to be obtained or released without cause.” (Id. at p. 10, italics added.) The language we have italicized above supports the conclusion that the ALPR statute was intended to give an individual the right to sue when that indiv