BILL ANALYSIS ------------------------------------------------------------ |SENATE RULES COMMITTEE | SB 1268| |Office of Senate Floor Analyses | | |1020 N Street, Suite 524 | | |(916) 651-1520 Fax: (916) | | |327-4478 | | ------------------------------------------------------------ THIRD READING Bill No: SB 1268 Author: Simitian (D) Amended: 5/28/10 Vote: 21 SENATE TRANSPORTATION & HOUSING COMMITTEE : 8-0, 4/6/10 AYES: Lowenthal, Huff, Ashburn, DeSaulnier, Kehoe, Oropeza, Pavley, Simitian NO VOTE RECORDED: Harman SENATE JUDICIARY COMMITTEE : 3-1, 4/13/10 AYES: Corbett, Hancock, Leno NOES: Walters NO VOTE RECORDED: Harman SENATE APPROPRIATIONS COMMITTEE : 6-3, 5/27/10 AYES: Kehoe, Alquist, Corbett, Leno, Wolk, Yee NOES: Denham, Walters, Wyland NO VOTE RECORDED: Cox, Price SUBJECT : Disclosure of personal information SOURCE : Author DIGEST : This bill prohibits, with some exceptions, a transportation agency from selling or otherwise providing personally identifiable information of a person who subscribes to an electronic toll collection system or who uses a toll facility that employs such system and establishes time periods up to which an agency may retain CONTINUED SB 1268 Page 2 that information. This bill also establishes a minimum amount of money a person whose personally identifiable information was knowingly sold or otherwise provided may receive in damages and costs. ANALYSIS : Toll agencies may employ an automatic vehicle identification system, referred to in this bill as an electronic toll collection system, to facilitate toll operations. FasTrak is the most common example of an automatic vehicle identification system in use in California. FasTrak systems allow subscribers to prepay tolls thereby eliminating the need to stop at the toll plaza. The system has three components: a transponder or toll tag, which is placed inside the vehicle; an antenna over the roadway that reads the transponder and deducts the toll amount from a subscriber's account; and video cameras that capture vehicles' license plates to identify toll evaders. The FasTrak system tracks a subscriber's usage and account balance. A monthly or quarterly statement itemizing bridge use and account balance is sent to subscribers via the postal mail or e-mail. Even though each toll agency operates only those facilities within its jurisdiction, existing law requires that the Department of Transportation (Caltrans) and toll operators develop functional specifications and standards for automatic vehicle identification systems so that vehicle owners not be required to purchase or install more than one device to use on all toll facilities in the state. This functionality is known as interoperability. In addition to FasTrak-type systems, some toll operators permit pay-by-plate toll payment which involves the use of on-road vehicle license plate identification technology. There are several ways in which pay-by-plate may work. For example, a person who uses a toll facility and does not have a FasTrak account or other automatic vehicle identification system could telephone or access the website of a toll operator, enter the license plate number of his/her vehicle, and pay the toll. Alternatively, a person may set up a pre-paid account so that tolls are deducted any time a vehicle uses the toll facility and his/her license plate number is captured. SB 1268 Page 3 Laws and regulations governing the use of personal information collected by automated systems are limited and somewhat fragmented. Existing law prohibits any information obtained through the use of automated devices from being used for any purpose other than to identify and obtain the mailing address of toll evasion violators or of persons entering a toll highway, toll lane, or toll bridge where pay-by-plate toll payment is permitted by the toll operator. Additionally, the Bay Area Toll Authority (BATA), as the toll operator for the seven state-owned toll bridges that employ FasTrak, is required to give vehicle owners the option of opening and maintaining an account with cash or check and without requiring them to provide their name or address. Finally, most toll operators have adopted some sort of privacy policy for account holders on their own accord. This bill establishes a framework guiding how a transportation agency may use personally identifiable information of a person who subscribes to an electronic toll collection system or uses a facility that employs an electronic toll collection system. In so doing, this bill: 1. Defines a "transportation agency" as Caltrans, the BATA, any entity operating a toll bridge, toll lane, or toll highway within the state, or any entity under contract with any of the above entities. 2. Prohibits a transportation agency from selling or otherwise providing personally identifiable information of any person subscribes or uses an electronic toll collection system. 3. Allows a transportation agency to provide such information to a law enforcement agency pursuant to a search warrant, provided the law enforcement agency immediately notifies, within five days, the person that his/her records have been obtained and provides a copy of the search warrant and the identity of the law enforcement agency or officer to whom the records were given. 4. Provides that a peace officer may obtain personally SB 1268 Page 4 identifiable information when conducting a criminal or traffic collision investigation without a search warrant if the officer has good cause to believe that a delay in obtaining a warrant would result in imminent danger to the health or safety of a member of the public. In this situation, the officer must provide the transportation agency a written statement setting forth his or her basis for good cause, notify the person immediately, but no later than five days from the day his/her records have been obtained, and provide the person the basis for obtaining the records. An officer may request a court order for a 30-day extension of the notice requirement if he/she believes notification would interfere with the investigation. 5. Requires a transportation agency to establish a privacy policy, post it on their Internet Web site, and provide it to subscribers in a manner that is conspicuous and meaningful, such as by providing a copy to the subscriber, or if the system does not use a collection mechanism, with the application materials. The privacy policy shall address the following issues: A. The type of personally identifiable information that is collected. B. The categories of third-party persons with whom the agency may share the information. C. The process by which an agency notifies subscribers of changes to the policy. D. The effective date of the policy. E. The process by which a subscriber may review and request changes to any of his/her information. 6. Allows a transportation agency to store personally identifiable information, such as account name, credit card number, billing address, vehicle information, and other basic account information for purposes of billing, account settlement, or enforcement. All other information must be discarded six months after the closure of the billing cycle or 60 days after the bill SB 1268 Page 5 has been paid, whichever occurs last. 7. Requires a transportation agency, on or after July 1, 2011, to "take every effort, within practical business and cost constraints," to purge personal account information within 60 days after the date the account is closed or terminated and specifies that in no case may a transportation agency retain personal information more than 150 days after the date an account is closed or terminated. 8. Establishes a minimum of $2,500 that a person whose personally identifiable information was knowingly sold or otherwise provided may receive in damages and costs. Raises the minimum to $4,000 if three or more violations occur. 9. Specifies that the bill does not prohibit a transportation agency from doing the following: A. Providing aggregated traveler information that relates to a group or category of subscribers from which personally identifiable information has been removed. B. Providing the license plate number of an intermodal chassis to the owner of the chassis for purposes of locating the driver of the chassis in the event the driver fails to pay the toll. C. Sharing data with another transportation agency solely to comply with interoperability specifications and standards adopted in accordance with existing law. D. Performing financial and accounting functions such as billing, account settlement, enforcement, or other financial activities required to operate and manage the toll facilities. E. Communicating about its products and services offered by itself, a business partner, or the agency with which it contracts to subscribers of the transportation agency through a contracted SB 1268 Page 6 third-party vendor using personally identifiable information limited to the subscriber's name, address, and electronic mail address, provided the transportation agency has received the subscriber's express written consent to receive the communication. 10.Specifies that a transportation agency may not use a nonsubscriber's personally identifiable information obtained using an electronic toll collection system to market products or services to that nonsubscriber, excluding toll-related products or services contained in a toll evasion notice. 11.Defines "personally identifiable information" as any information that identifies or describes a person, including, but not limited to, travel pattern data, address, telephone number, e-mail address, license plate number, photograph, bank account information, or credit card number. 12.Specifies that nothing in items #6 and #7 above precludes compliance with a court order or settlement agreement that has been approved on or before April 25, 2010. 13.Allows a transportation agency that employs an electronic toll collection system to impose an administrative fee on the persons who use that system in an amount sufficient to cover the cost of this bill. FISCAL EFFECT : Appropriation: No Fiscal Com.: Yes Local: Yes According to the Senate Appropriations Committee: Fiscal Impact (in thousands) Major Provisions 2010-11 2011-12 2012-13 Fund User privacy protections Prohibits sales/sharing $0 $0 $0 Local* Retention restrictions Unknown potential costs, SB 1268 Page 7 recovered by fees Local* * Transit authorities SUPPORT : (Verified 5/28/10) American Civil Liberties Union Consumer Action Consumer Federation of California Electronic Frontier Foundation Privacy Rights Clearinghouse OPPOSITION : (Verified 5/28/10) Orange County Transportation Authority San Diego Association of Governments South Bay Expressway Transportation Corridor Agencies ARGUMENTS IN SUPPORT : According to the author's office, this bill is intended to protect the privacy of motorists in California by controlling the use of personal information that is collected and stored by electronic toll collection systems (e.g., FasTrak). Examples of personal information include travel pattern data, location, speed, time of day, address, telephone number, bank account information, and credit card numbers. In addition to facilitating toll payment, FasTrak transponders are also used to collect traffic information such as travel times. The signal emitted by a transponder is detected by sensors or meters that have been placed along the roadway on certain highway segments. These data are aggregated and used to provide real-time traffic information via Caltrans' changeable message signs and services as the Bay Area's 511.org. The author's office states that there is a legitimate concern that information originally collected for purposes of electronic toll collection or the provision of travel information could be provided to other companies or organizations for marketing purposes. Existing restrictions on information sharing and sales vary among transportation agencies. By codifying the standards SB 1268 Page 8 contained in this bill, the author contends the bill will assure that privacy protections extend to all transportation agencies that have, or may acquire, electronic data collection technologies. ARGUMENTS IN OPPOSITION : South Bay Expressway (SBX) states: "While we support the privacy protection and penalty provisions of SB 1268, we have difficulty supporting the proposed information purging requirements. The statute of limitations on consumer claims under Business and Professions Code 17200 is four years. We believe that if there is to be a purging requirement, it should be after four years at a minimum for the protection of both the consumer and California's toll operators if any future claims should arise. The purging requirement also would result in additional one-time and ongoing costs for SBX. These include developing new software and hardware configurations to accomplish the purging of data as well as ongoing staff costs to administer the process. While we are a relatively small toll operator, the costs to SBX could be several hundred thousand dollars in implementation costs and tens of thousands of dollars of annual costs." JJA:mw 5/28/10 Senate Floor Analyses SUPPORT/OPPOSITION: SEE ABOVE **** END ****