BILL ANALYSIS ------------------------------------------------------------ |SENATE RULES COMMITTEE | SB 1268| |Office of Senate Floor Analyses | | |1020 N Street, Suite 524 | | |(916) 651-1520 Fax: (916) | | |327-4478 | | ------------------------------------------------------------ UNFINISHED BUSINESS Bill No: SB 1268 Author: Simitian (D) Amended: 8/20/10 Vote: 21 SENATE TRANSPORTATION & HOUSING COMMITTEE : 8-0, 4/6/10 AYES: Lowenthal, Huff, Ashburn, DeSaulnier, Kehoe, Oropeza, Pavley, Simitian NO VOTE RECORDED: Harman SENATE JUDICIARY COMMITTEE : 3-1, 4/13/10 AYES: Corbett, Hancock, Leno NOES: Walters NO VOTE RECORDED: Harman SENATE APPROPRIATIONS COMMITTEE : 6-3, 5/27/10 AYES: Kehoe, Alquist, Corbett, Leno, Wolk, Yee NOES: Denham, Walters, Wyland NO VOTE RECORDED: Cox, Price SENATE FLOOR : 24-10, 6/1/10 AYES: Aanestad, Alquist, Ashburn, Calderon, Cedillo, Corbett, DeSaulnier, Florez, Hancock, Huff, Kehoe, Leno, Liu, Lowenthal, Negrete McLeod, Padilla, Pavley, Price, Romero, Simitian, Steinberg, Wolk, Wright, Yee NOES: Cogdill, Correa, Cox, Denham, Dutton, Harman, Hollingsworth, Runner, Strickland, Wyland NO VOTE RECORDED: Ducheny, Oropeza, Walters, Wiggins, Vacancy, Vacancy ASSEMBLY FLOOR : 57-13, 8/23/10 - See last page for vote CONTINUED SB 1268 Page 2 SUBJECT : Disclosure of personal information SOURCE : Author DIGEST : This bill prohibits, with some exceptions, a transportation agency from selling or otherwise providing personally identifiable information of a person who subscribes to an electronic toll collection system or who uses a toll facility that employs such system and establishes time periods up to which an agency may retain that information. This bill also establishes a minimum amount of money a person whose personally identifiable information was knowingly sold or otherwise provided may receive in damages and costs. Assembly Amendments increase the amount of time a transportation agency can store personally identifiable information, and revise the circumstances in which a transportation agency can make personally identifiable information available to law enforcement. ANALYSIS : Toll agencies may employ an automatic vehicle identification system, referred to in this bill as an electronic toll collection system, to facilitate toll operations. FasTrak is the most common example of an automatic vehicle identification system in use in California. FasTrak systems allow subscribers to prepay tolls thereby eliminating the need to stop at the toll plaza. The system has three components: a transponder or toll tag, which is placed inside the vehicle; an antenna over the roadway that reads the transponder and deducts the toll amount from a subscriber's account; and video cameras that capture vehicles' license plates to identify toll evaders. The FasTrak system tracks a subscriber's usage and account balance. A monthly or quarterly statement itemizing bridge use and account balance is sent to subscribers via the postal mail or e-mail. Even though each toll agency operates only those facilities within its jurisdiction, existing law requires that the Department of Transportation (Caltrans) and toll operators develop functional specifications and standards for SB 1268 Page 3 automatic vehicle identification systems so that vehicle owners not be required to purchase or install more than one device to use on all toll facilities in the state. This functionality is known as interoperability. In addition to FasTrak-type systems, some toll operators permit pay-by-plate toll payment which involves the use of on-road vehicle license plate identification technology. There are several ways in which pay-by-plate may work. For example, a person who uses a toll facility and does not have a FasTrak account or other automatic vehicle identification system could telephone or access the website of a toll operator, enter the license plate number of his/her vehicle, and pay the toll. Alternatively, a person may set up a pre-paid account so that tolls are deducted any time a vehicle uses the toll facility and his/her license plate number is captured. Laws and regulations governing the use of personal information collected by automated systems are limited and somewhat fragmented. Existing law prohibits any information obtained through the use of automated devices from being used for any purpose other than to identify and obtain the mailing address of toll evasion violators or of persons entering a toll highway, toll lane, or toll bridge where pay-by-plate toll payment is permitted by the toll operator. Additionally, the Bay Area Toll Authority (BATA), as the toll operator for the seven state-owned toll bridges that employ FasTrak, is required to give vehicle owners the option of opening and maintaining an account with cash or check and without requiring them to provide their name or address. Finally, most toll operators have adopted some sort of privacy policy for account holders on their own accord. This bill establishes a framework guiding how a transportation agency may use personally identifiable information of a person who subscribes to an electronic toll collection system or uses a facility that employs an electronic toll collection system. In so doing, this bill: 1. Defines a "transportation agency" as Caltrans, the BATA, any entity operating a toll bridge, toll lane, or toll SB 1268 Page 4 highway within the state, or any entity under contract with any of the above entities. 2. Prohibits a transportation agency from selling or otherwise providing personally identifiable information of any person subscribes or uses an electronic toll collection system. 3. Allows a transportation agency to provide such information to a law enforcement agency pursuant to a search warrant, provided the law enforcement agency immediately notifies, within five days, the person that his/her records have been obtained and provides a copy of the search warrant and the identity of the law enforcement agency or officer to whom the records were given. 4. Provides that a peace officer may obtain personally identifiable information when conducting a criminal or traffic collision investigation without a search warrant if the officer has good cause to believe that a delay in obtaining a warrant would cause an adverse result, as defined. 5. Requires a transportation agency to establish a privacy policy, post it on their Internet Web site, and provide it to subscribers in a manner that is conspicuous and meaningful, such as by providing a copy to the subscriber, or if the system does not use a collection mechanism, with the application materials. The privacy policy shall address the following issues: A. The type of personally identifiable information that is collected. B. The categories of third-party persons with whom the agency may share the information. C. The process by which an agency notifies subscribers of changes to the policy. D. The effective date of the policy. E. The process by which a subscriber may review and SB 1268 Page 5 request changes to any of his/her information. 6. Allows a transportation agency to store personally identifiable information, such as account name, credit card number, billing address, vehicle information, and other basic account information for purposes of billing, account settlement, or enforcement. All other information, on and after July 1, 2011, must be discarded no more than four years and six months after the closure of the billing cycle or 60 days after the bill has been paid, and all toll violations, if any, have been resolved. 7. Requires a transportation agency, on or after July 1, 2011, to "take every effort, within practical business and cost constraints," to purge personal account information that is closed or terminated and specifies that in no case may a transportation agency retain personal information more than four years and six months after the date an account is closed or terminated. 8. Establishes a minimum of $2,500 that a person whose personally identifiable information was knowingly sold or otherwise provided may receive in damages and costs. Raises the minimum to $4,000 if three or more violations occur. 9. Specifies that the bill does not prohibit a transportation agency from doing the following: A. Providing aggregated traveler information that relates to a group or category of subscribers from which personally identifiable information has been removed. B. Providing the license plate number of an intermodal chassis to the owner of the chassis for purposes of locating the driver of the chassis in the event the driver fails to pay the toll. C. Sharing data with another transportation agency solely to comply with interoperability specifications and standards adopted in accordance with existing law. SB 1268 Page 6 D. Performing financial and accounting functions such as billing, account settlement, enforcement, or other financial activities required to operate and manage the toll facilities. E. Communicating about its products and services offered by itself, a business partner, or the agency with which it contracts to subscribers of the transportation agency through a contracted third-party vendor using personally identifiable information limited to the subscriber's name, address, and electronic mail address, provided that, for customer agreements entered into on or after January 1, 2011, the transportation agency has received the subscriber's express written consent to receive the communication. 10.Specifies that a transportation agency may not use a nonsubscriber's personally identifiable information obtained using an electronic toll collection system to market products or services to that nonsubscriber, excluding toll-related products or services contained in a toll evasion notice. 11.Defines "personally identifiable information" as any information that identifies or describes a person, including, but not limited to, travel pattern data, address, telephone number, e-mail address, license plate number, photograph, bank account information, or credit card number. 12.Specifies that nothing in items #6 and #7 above precludes compliance with a court order or settlement agreement that has been approved on or before April 25, 2010. 13.Allows a transportation agency that employs an electronic toll collection system to impose an administrative fee on the persons who use that system in an amount sufficient to cover the cost of this bill. FISCAL EFFECT : Appropriation: No Fiscal Com.: Yes Local: Yes SB 1268 Page 7 According to the Senate Appropriations Committee: Fiscal Impact (in thousands) Major Provisions 2010-11 2011-12 2012-13 Fund User privacy protections Prohibits sales/sharing $0 $0 $0 Local* Retention restrictions Unknown potential costs, recovered by fees Local* * Transit authorities SUPPORT : (Verified 8/23/10) American Civil Liberties Union Consumer Action Consumer Federation of California Electronic Frontier Foundation Privacy Rights Clearinghouse ARGUMENTS IN SUPPORT : According to the author's office, this bill is intended to protect the privacy of motorists in California by controlling the use of personal information that is collected and stored by electronic toll collection systems (e.g., FasTrak). Examples of personal information include travel pattern data, location, speed, time of day, address, telephone number, bank account information, and credit card numbers. In addition to facilitating toll payment, FasTrak transponders are also used to collect traffic information such as travel times. The signal emitted by a transponder is detected by sensors or meters that have been placed along the roadway on certain highway segments. These data are aggregated and used to provide real-time traffic information via Caltrans' changeable message signs and services as the Bay Area's 511.org. The author's office states that there is a legitimate concern that information originally collected for purposes SB 1268 Page 8 of electronic toll collection or the provision of travel information could be provided to other companies or organizations for marketing purposes. Existing restrictions on information sharing and sales vary among transportation agencies. By codifying the standards contained in this bill, the author contends the bill will assure that privacy protections extend to all transportation agencies that have, or may acquire, electronic data collection technologies. ASSEMBLY FLOOR : AYES: Ammiano, Arambula, Bass, Beall, Block, Blumenfield, Bradford, Brownley, Buchanan, Caballero, Charles Calderon, Carter, Chesbro, Conway, Coto, De La Torre, De Leon, Eng, Evans, Feuer, Fletcher, Fong, Galgiani, Gatto, Gilmore, Hall, Hayashi, Hernandez, Hill, Huber, Huffman, Jones, Lieu, Bonnie Lowenthal, Ma, Mendoza, Monning, Nava, Nestande, Niello, Nielsen, V. Manuel Perez, Portantino, Ruskin, Salas, Saldana, Skinner, Solorio, Audra Strickland, Swanson, Torlakson, Torres, Torrico, Tran, Villines, Yamada, John A. Perez NOES: Adams, Anderson, Bill Berryhill, Tom Berryhill, DeVore, Fuller, Gaines, Harkey, Knight, Logue, Miller, Norby, Smyth NO VOTE RECORDED: Cook, Davis, Fuentes, Furutani, Garrick, Hagman, Jeffries, Silva, Vacancy, Vacancy JJA:mw 8/24/10 Senate Floor Analyses SUPPORT/OPPOSITION: SEE ABOVE **** END ****