It records where someone was, and you don't know what that reveals about someone.
This part is discussed in a lot of comments and answers. An overview:
You drive around with it all day, so it gets lots of exposure already. However, that doesn't mean that even more exposure is desirable. Aganju's answer explains:
posting on the internet opens that information to a much larger number of people everywhere in the world, not just locals that care to look. [...] Also, on the internet, it's shared forever.
And O. R. Mapper comments on another answer:
the information that someone owns a given car with a given license plate is arguably "public" [but] the information that this car (and thus, probably, its owner) was at a specific location at a specific time may be a very different story.
Alright, so the internet has a higher chance of containing someone who can use the data to harm you, than if you limit the exposure to those around you... but what evil things could someone do with something that is already so public?
Lots of people can think of an answer to this:
- "it is easy for stalkers or jealous wife/husband/whatever to remember a few license plates and recognize them when they encounter them by chance", A. Hersean answers
- "In the UK people often obscure licence plates in photographs they post online to protect themselves or the vehicle's registered keeper (often the owner) from "number plate cloning"." Andy Vaal answers
- "In Scandinavian countries road authorities have a publicly accessible service where you can get the name, address, and phone number of the license plate owner," index comments
- "If someone that knows that the car CT-90-GEO is usually parked on a given house at night and then sees a post on social media that shows the car CT-90-GEO 90 miles away at a party, the person will know that the house is probably empty and thus vulnerable to a burglar," T. Sar comments
- It's not hard to think of another: You might know your girlfriend won't see your car being somewhere, but she might still see the picture someone randomly took of your car near your ex's house. It might raise some questions and seed doubt, even if your business there was benign or even unrelated.
It creates permanent records of things that are otherwise fleeting. You might also consider that it is costly to be everywhere in the world and record movements of a large amount of people, but it is very cheap to collect this data from your armchair.
These reasons might not apply everywhere in the world, or to every individual, but are you sure it does not apply to each of the license plates in your picture? They did not ask you to share it, so why do you need to do it? It's their data, they have a right to choose what happens to it. Which brings us to the legal aspect.
In case your picture contains (a) license plate(s) that are not of your car, it may not be legal to share this online.
I can only speak for the European Union, where we had privacy guidelines since 1994 (Data Protection Directive, implemented as laws by many countries) and legislation since 2016 (General Data Protection Regulation). Privacy is part of the European Convention on Human Rights.
The definition of personally identifiable information (PII) according to the DPD is (paraphrased): any information about a person who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity. GDPR slightly broadens this:
any information [identifying a person], directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
So it does not matter that I cannot trace that NL 12-ABC-89 belongs to Jan de Vries, it matters that there exists an entity which can do this. Therefore it is PII. This means you need a reason to process the data, which can be:
- You asked me and I agreed (i.e. consent)
- It is necessary for a contract (e.g. I asked you to go and buy me a new license plate)
- When processing is necessary for compliance with a legal obligation
- when processing is necessary in order to protect the vital interests of the data subject (e.g. I was in a car crash and you need to look up, using my license plate, what my blood type is and whether I have any known bad reactions to medicines)
- Or one of a few other, less common reasons.
Alright, but you just took a picture of good weather on your business trip, and a car happened to drive by. Can you really not show your wife? Yes, under GDPR you can. Wikipedia cites:
The regulation does not apply to the processing of data by a person for a "purely personal or household activity and thus with no connection to a professional or commercial activity."