BILL ANALYSIS SB 1268 Page 1 SENATE THIRD READING SB 1268 (Simitian) As Amended August 20, 2010 Majority vote SENATE VOTE :24-10 TRANSPORTATION 10-2 JUDICIARY 10-0 ----------------------------------------------------------------- |Ayes:|Bonnie Lowenthal, |Ayes:|Feuer, Tran, Brownley, | | |Blumenfield, Buchanan, | |Evans, Hagman, Huffman, | | |Eng, Galgiani, Hayashi, | |Jones, Knight, Monning, | | |Niello, Norby, | |Saldana | | |Portantino, Solorio | | | | | | | | |-----+--------------------------+-----+--------------------------| |Nays:|Bill Berryhill, Miller | | | | | | | | ----------------------------------------------------------------- APPROPRIATIONS 16-0 ----------------------------------------------------------------- |Ayes:|Fuentes, Conway, | | | | |Bradford, | | | | |Charles Calderon, Coto, | | | | |Davis, | | | | |De Leon, Gatto, Hall, | | | | |Miller, Nielsen, Norby, | | | | |Skinner, Solorio, | | | | |Torlakson, Torrico | | | | | | | | ----------------------------------------------------------------- SUMMARY : Prohibits transportation agencies from selling or disseminating personal information of their subscribers, with exceptions; imposes penalties for breaching this restriction. Specifically, this bill : 1)Prohibits transportation agencies from selling or disseminating personal information about persons who subscribe to electronic toll or fare payment systems. 2)Requires transportation agencies that use electronic toll collection systems to establish privacy policies and to provide those policies to subscribers. SB 1268 Page 2 3)Requires privacy policies to address, at a minimum, the following: a) The type of information collected by the transportation agency; b) The types of third-party persons or entities with whom the transportation agency may share personal information; c) The process by which subscribers are informed of changes in the privacy policy; d) The effective date of the privacy policy; and, e) The process by which a subscriber may review their own personal information. 4)Authorizes transportation agencies to store specific account related information such as an account holder's name, credit card number, and billing addresses; beginning July 1, 2011, all other information must be discarded no later than four years and six months after the closure date of a billing cycle and the bill has been paid and all toll violations, if applicable, have been resolved. 5)Beginning July 1, 2011, requires transportation agencies to make every effort to purge data on closed accounts; in no case may data be stored longer than four years and six months after an account has been closed or terminated. 6)Allows transportation agencies to make personally identifiable information available to law enforcement agencies, pursuant to a search warrant; generally requires a law enforcement agency to notify within five days someone that their information has been obtained from the transportation agency. 7)Allows peace officers conducting criminal or traffic collision investigations to obtain personally identifiable information of subscribers if the officer has good cause to believe that a delay in obtaining the information via a search warrant may result in an adverse result, as defined. 8)Allows transportation agencies to provide aggregated traveler information that relates to a group or category of SB 1268 Page 3 subscribers, provided that personally identifiable information has been removed. 9)Allows the sharing of data among transportation agencies in order to comply with state inter-operability requirements for electronic toll collection systems. 10)Allows transportation agencies to communicate to their subscribers exclusively about their products and services through contracted third party vendors using the subscribers' names and addresses, provided that the transportation agency, for customer agreements entered into on or after January 1, 2011, has received the subscriber's express written consent to receive the communication. 11)For purposes of these provisions, defines "transportation agency" as the California Department of Transportation (Caltrans), the Bay Area Toll Authority, any entity operating a toll bridge, toll lane, or toll highway, or any entity operating under contract with such an agency. 12)Defines other key terms. 13)Provides that a breach in the use of personal information may result in an action to recover actual damages or $2,500, whichever is greater, for each individual violation, in addition to attorney's fees. 14)If a person's information has been knowingly sold or otherwise provided three or more times, increases the penalty to actual damages or $4,000, whichever is greater, in addition to attorney's fees. 15)Stipulates that this bill's provisions do not preclude compliance with a specific court-ordered settlement agreement. 16)Authorizes a transportation agency to impose an administrative fee to cover costs associated with implementing these privacy requirements. EXISTING LAW authorizes Caltrans, cities, counties, public transit agencies, and special districts to assess tolls and fares for the use of transportation facilities under their respective jurisdictions. SB 1268 Page 4 FISCAL EFFECT: According to the Assembly Appropriations Committee, no impact to Caltrans, as such personal identifiable information is kept by the local transportation agencies that operate toll systems. Any costs to local transportation agencies can be covered through administrative fees authorized in the bill. COMMENTS: According to the author, SB 1268 is intended to protect the privacy of motorists in California by controlling the use of personal information that is collected and stored by electronic toll collection systems. The author states that SB 1268 provides important privacy protections to drivers by: 1) prohibiting a transportation agency that operates a toll facility from releasing or selling personal identifying information of subscribers to an automatic toll collecting service; and, 2) establishing a data retention period for how long agencies can retain personal information in their systems. Supporters of this bill suggest that California has witnessed a growing trend of attorneys, law enforcement agencies, and other entities requesting and obtaining data on electronic toll collection system users via a subpoena. They support the personal information protections provided for in SB 1268. Transportation agencies generally support this bill's provisions related to privacy protections for their toll customers. Previously raised concerns, that the length of time personal data can be stored should be consistent with the statue of limitations for civil actions, appear to have been eliminated with amendments taken to the bill that allow personal data to be stored up to four and a half years. Analysis Prepared by : Janet Dawson / TRANS. / (916) 319-2093 FN: 0006498