BILL ANALYSIS
SENATE JUDICIARY COMMITTEE
Senator Ellen M. Corbett, Chair
2009-2010 Regular Session
SB 1268 (Simitian)
As Amended April 5, 2010
Hearing Date: April 13, 2010
Fiscal: Yes
Urgency: No
SK:jd
SUBJECT
Toll Bridges, Lanes, and Highways: Electronic Toll Collection
Mechanisms:
Disclosure of Personal Information
DESCRIPTION
This bill would impose privacy restrictions on transportation
agencies, such as the California Department of Transportation
(Caltrans), the Bay Area Toll Authority, and any entity that
operates a toll bridge, lane, or highway. Specifically, this
bill would prohibit these entities from selling, or providing to
any other person, the personally identifiable information of
either subscribers of an electronic toll collection system or
anyone who uses a toll bridge, lane, or highway that utilizes an
electronic toll collection system. This bill would specify
several exceptions to this prohibition and include a
privacy-policy notice requirement to subscribers, as specified.
BACKGROUND
Existing law authorizes the use of automatic vehicle
identification systems for toll collection. Systems such as
FasTrak have gained popularity with motorists who subscribe in
order to prepay tolls and avoid a stop at the toll plaza. The
FasTrak Web site describes the system, "As your vehicle enters
the toll lane, the toll tag (1) that is mounted on your
vehicle's windshield is read by the antennae (2). As your
vehicle passes through, your FasTrak account is charged the
proper amount. Feedback is provided to you on an electronic
display (3). If your vehicle does not have a toll tag, the
system classifies you as a violator and cameras take photos of
(more)
SB 1268 (Simitian)
Page 2 of ?
your vehicle and your license plate for processing." According
to the Metropolitan Transportation Commission, the only
information stored on the FasTrak tag is the tag number; there
is no customer personal information stored on the actual tag.
Instead, that information is stored at the FasTrak customer
service center.
Systems such as FasTrak track subscriber usage and account
balance. They also have the ability to track information such
as location and speed of the vehicle, time of day, and other
personal information. As noted above, electronic toll systems
may capture photos of vehicles and license plates in order to
identify toll violators. As a result, transportation agencies
that operate these systems may collect and store significant
amounts of personal information about California's motorists.
Some transportation agencies that use automatic vehicle location
technology to monitor traffic flow and collect tolls have
privacy policies that mirror closely some of the provisions of
this bill, but the author notes that these policies can vary
among transportation agencies. In order to address these
concerns and ensure that personally identifiable information
collected using electronic toll collection systems is not
inappropriately used for marketing purposes, this bill would
impose various privacy restrictions on transportation agencies
that use electronic toll collection systems.
This bill was approved by the Transportation and Housing
Committee on April 6, 2010 by a vote of 8-0.
CHANGES TO EXISTING LAW
Existing law provides that, among other rights, all people have
an inalienable right to pursue and obtain privacy. (Cal.
Const., art. I, Sec. I.)
Existing law , the Information Practices Act (IPA), imposes
limitations on state agencies' collection and disclosure of
personal information and specifically declares that the right to
privacy is a personal and fundamental right and that all
individuals have a right of privacy in information pertaining to
them. (Civ. Code Sec. 1798.1.) The IPA also provides that an
individual's name and address may not be distributed for
commercial purposes, sold, or rented by an agency unless such
action is specifically authorized by law. (Civ. Code Sec.
1798.60.) The IPA applies to state agencies such as Caltrans,
but does not apply to transportation agencies or other local
SB 1268 (Simitian)
Page 3 of ?
entities. (Civ. Code Sec. 1798.3.)
Existing law provides that Caltrans has exclusive jurisdiction
to grant franchises, privileges, or licenses for the
construction or operation of toll bridges, toll roads, and toll
ferries and for the taking and keeping of tolls from the
bridges, roads, and ferries situated wholly or in part within
the state. (Sts. & Hy. Code Sec. 30800.)
Existing law permits Caltrans to fix the rate of tolls and to
make orders and prescribe rules and regulations concerning toll
roads, toll bridges, or toll ferries. (Sts. & Hy. Code Secs.
30803, 30807.)
Existing law permits the use of automatic vehicle identification
systems for toll collection. (Sts. & Hy. Code Sec. 27564.)
This bill would prohibit transportation agencies, including
Caltrans, the Bay Area Toll Authority, and any entity that
operates a toll bridge, lane, or highway, from selling, or
providing to any other person, the personally identifiable
information of either: (1) subscribers of an electronic toll
collection system; or (2) anyone who uses a toll bridge, lane,
or highway that utilizes an electronic toll collection system.
This bill would specify that such personally identifiable
information includes, but is not limited to, an individual's
travel pattern data, address, telephone number, bank account
information, or credit card number.
This bill would require a transportation agency that uses an
electronic toll collection system to establish a privacy policy
concerning the collection and use of personally identifiable
information and to provide a copy of that policy to subscribers
in a manner that is conspicuous and meaningful. This bill would
require that the policy include the following:
1. the types of personally identifiable information collected by
the agency;
2. the categories of third-party persons or entities with whom
the agency may share personally identifiable information;
3. the process by which a transportation agency notifies
subscribers of material changes to its privacy policy;
4. the effective date of the privacy policy; and
5. the process by which a subscriber may review and request
changes to any of his or her personally identifiable
information.
SB 1268 (Simitian)
Page 4 of ?
This bill would permit a transportation agency, within practical
business and costs constraints, to store an individual's
personally identifiable information such as account name, credit
card number, billing address, vehicle information, and other
basic account information required to perform functions such as
billing, account settlement, or enforcement activities. All
other information must be discarded six months after the closure
date of the billing cycle or 60 days after the bill has been
paid, whichever occurs last.
This bill would require a transportation agency to take every
effort, within practical business and costs constraints, to
purge the personal account information within 60 days after the
date the account is closed or terminated. This bill would
provide that in no case may a transportation agency maintain
personal information more than 150 days after an account is
closed or terminated.
This bill would provide that a transportation agency may only
make personally identifiable information available to a law
enforcement agency pursuant to a search warrant. Absent a
provision in the search warrant to the contrary, this bill would
require law enforcement to immediately, but not more than 15
days, notify the individual that his or her records have been
obtained by law enforcement. Law enforcement would further be
required to provide the individual a copy of the search warrant
and the identity of the law enforcement agency or peace officer
to whom the records were provided.
This bill would permit a peace officer, when conducting a
criminal or traffic collision investigation, to obtain an
individual's personally identifiable information if the officer
has good cause to believe that a delay in obtaining the
information by seeking a search warrant would result in imminent
danger to the health or safety of a member of the public. In
this case, this bill would require the peace officer to provide
the transportation agency with a written statement describing
the basis for the good-cause belief and also provide the
individual with notice, immediately or within no more than 15
days, that his or her information was obtained.
This bill would not prohibit a transportation agency from
providing aggregated traveler information where all personally
identifiable information has been removed.
SB 1268 (Simitian)
Page 5 of ?
This bill would permit a transportation agency to share data
with another agency solely to comply with interoperability
specifications and standards concerning electronic toll
collection devices and technologies.
This bill would permit a transportation agency to communicate
exclusively with subscribers about its transportation-related
products and services on behalf of itself or the agency with
which it contracts through a contracted third-party vendor using
personally identifiable information limited to the subscriber's
name, address, and electronic mail address. This bill would
require that each communication must contain a clear and
conspicuous notice and instructions to the subscriber about the
process for terminating any such future communications.
This bill would define "electronic toll collection system" to
mean a system where a transponder, camera-based vehicle
identification system, or other electronic medium is used to
deduct payment of a toll from a subscriber's account or to
establish an obligation to pay a toll.
This bill would provide that, in addition to any other remedies
provided by law, a person whose personally identifiable
information has been knowingly sold or otherwise provided in
violation of the bill may bring an action to recover either
actual damages or $2,500 for each individual violation,
whichever is greater, and reasonable costs and attorney's fees.
COMMENT
1. Stated need for the bill
The author writes:
This bill is intended to protect the privacy of motorists in
California by controlling the use of personal information that
is collected and stored by electronic toll collection systems
. . . Existing restrictions on information sharing and sales
are policy-based and vary between transportation agencies. SB
1268 will assure that these privacy protections are codified
in statute and extended to all transportation agencies that
have, or may acquire, electronic data-collection technologies.
. . . MTC [the Metropolitan Transportation Commission] has
implemented its TravInfo 511 system which allows drivers to
dial 5-1-1 from their telephone to hear free up-to-the-minute
SB 1268 (Simitian)
Page 6 of ?
traffic information. A crucial part of this system is a
website to provide commuters with real-time traffic
information . . . The system relies on an elaborate
data-gathering network that MTC and Caltrans have been
installing along area freeways in recent years. 511 is able
to provide real-time traffic information by monitoring the
speed and location of drivers equipped with FasTrak devices as
they move past strategically placed meters. MTC reports that
the data is encrypted for anonymity and discarded daily, with
no historical database being maintained.
While helpful to motorists looking for the quickest or easiest
possible route to their destinations, the additional use of
FasTrak devices originally purchased for electronic payment of
tolls on bridges and toll roads, begs the question of driver
privacy. There is a legitimate concern that information
originally collected for FasTrak uses (i.e. location, speed,
time of day, license plate number, make/model of vehicle, home
address, etc.) could be disseminated to other companies or
organizations for marketing purposes.
Privacy Rights Clearinghouse writes in support of the bill,
stating:
Subscriber privacy has further been put in jeopardy due to
storage of subscriber information, including travel pattern
data and toll transactions, for indefinite periods of time by
transportation agencies. The stored data include information
on accounts that have closed and tickets that have been
resolved for years. This creates data-rich files on all
subscribers, which could then be accessed by third-parties
without the permission of the subscriber. SB 1268 would
remedy this unnecessary amassing of subscriber data by
creating clear guidelines for data retention and data
destruction.
2. Bill would require privacy policy and related notice
This bill would require that a transportation agency that uses
an electronic toll collection system establish a privacy policy
regarding the collection and use of personally identifiable
information. That policy must be provided to individuals who
subscribe to the system in a manner that is conspicuous and
meaningful. The policy must also include specified information,
including the types of personally identifiable information
collected by the agency, the categories of third-party persons
SB 1268 (Simitian)
Page 7 of ?
or entities with whom the agency may share personally
identifiable information, the process by which a transportation
agency notifies subscribers of material changes to its privacy
policy, the effective date of the privacy policy, and the
process by which a subscriber may review and request changes to
any of his or her personally identifiable information.
This bill's requirements concerning the content of the privacy
policy track existing Business and Professions Code Section
22575, added by the author's AB 68 (Simitian, Ch. 829, Stats.
2003), which imposes requirements on commercial Web site
operators and online services that collect personally
identifiable information about California residents. In
addition, these requirements appear to be consistent with some
transportation agencies use of subscribers' personal
information. For example, FasTrak's privacy policy describes
all of the elements required by this bill.
a. Manner in which the privacy policy is provided to
subscribers
This bill would require that the agency's privacy policy be
provided to subscribers "in a manner that is conspicuous and
meaningful." This phrase is not defined, however, and in
order to ensure that a subscriber is provided this important
information, the author has agreed to amend the bill to
require that a paper copy of the privacy policy be included
with the transponder or other electronic toll collection
mechanism when it is provided to the subscriber.
Suggested amendment:
On page 2, line 27, after "meaningful" insert "including by
providing a copy to the subscriber with the electronic toll
collection mechanism, such as a transponder or other device
or, if the system does not use a mechanism, with the
application materials."
b. Ensuring users of toll bridges and roads are provided
notice of the agency's privacy policy
Although the privacy protections contained in this bill apply
to individuals who subscribe to an electronic toll system as
well as users of toll bridges and roads, the privacy-policy
notice requirement applies only to subscribers to the system.
As a result, the bill requires only that subscribers be
provided a copy of the privacy policy, but not users of the
SB 1268 (Simitian)
Page 8 of ?
toll bridges and roads. In order to ensure that users of
those bridges and roads receive sufficient notice of how the
agency collects and uses personally identifiable information,
the author has agreed to amend the bill to require that the
privacy policy be posted on the homepage of the agency's
Internet Web site.
Suggested amendment:
On page 2, line 27, after the period, insert "A
transportation agency shall conspicuously post its privacy
policy on its Internet Web site. For purposes of this
section, "conspicuously post" has the same meaning as that
term is defined in Section 22577(b)(1)-(4) of the Business
and Professions Code."
3. Personally identifiable information
This bill would prohibit transportation agencies that operate
electronic toll collection systems from selling or providing
personally identifiable information including, but not limited
to, an individual's travel pattern data, address, telephone
number, bank account information, or credit card number.
Although this list is not intended to be exhaustive, it does
omit a few items of personally identifiable information which
appear to be collected by some transportation agencies. For
example, the FasTrak system collects other personal information
such as email address, license plate number, and "other
information that personally identifies a FasTrak user." In
order to ensure that an individual's personally identifiable
information is protected, the author has agreed to amend the
bill to insert a definition of "personally identifiable
information" in the bill.
Suggested amendment:
On page 2, beginning on line 8, strike ", including, but not
limited to, travel pattern data, address, telephone number,
bank account information, or credit card number,"
On page 6, insert a new subdivision (n) to read: "(n) For
purposes of this section, "personally identifiable
information" means any information that identifies or
describes a person, including, but not limited to, travel
pattern data, address, telephone number, email address,
SB 1268 (Simitian)
Page 9 of ?
license plate number, photograph, bank account information, or
credit card number."
4. Communications for transportation-related products and
services
a. Marketing to users of toll bridges and roads
Under this bill, a transportation agency would be permitted to
communicate exclusively with its subscribers about its
transportation-related products and services "on behalf of
itself or the agency with which it contracts" through a
contracted third-party vendor using personally identifiable
information limited to the subscriber's name, address, and
electronic mail address. This provision applies only to
subscribers, but not to users of toll bridges and roads. In
the event that the transportation agency captures a user's
license plate, however, the agency is able, through the
Department of Motor Vehicles, to obtain personally
identifiable information (such as name and address) about the
user. These users do not have a subscription-based
relationship with the agency, however, and it is arguably
inappropriate to permit marketing to these individuals. As a
result, the author has agreed to amend the bill to prohibit
marketing to users of toll bridges and roads.
SB 1268 (Simitian)
Page 10 of ?
Suggested amendment:
Add a new subdivision (k) to read:
A transportation agency may not use a non-subscriber's
personally identifiable information obtained using an
electronic toll collection system to market products or
services to that non-subscriber.
b. Marketing to subscribers of an electronic toll
collection system
This bill currently requires that each communication must
contain a clear and conspicuous notice and instructions to the
subscriber about the process for terminating any future
communications. This language is intended to provide
subscribers with the ability to opt-out of marketing
communications, but it inadvertently does not contain a
substantive requirement that transportation agencies offer the
opportunity to opt-out of future communications. In order to
address this issue, the bill should be amended to actually
contain such a requirement.
Suggested amendment:
On page 5, line 5, after the period, insert "A
transportation agency shall provide a person who receives a
communication pursuant to this subdivision with an
opportunity to opt-out of future communications and shall
establish a process for terminating those future
communications."
In the alternative, however, because an opt-in requirement is
more protective of a subscriber's privacy because it requires
that the subscriber consent to the marketing before it occurs,
the Committee may wish to amend the bill to instead subject
this marketing to an opt-in. The following amendments would
accomplish this:
Suggested amendments:
On page 5, line 5, after "address" insert "provided that
the transportation agency has received the subscriber's
express written consent to receive such communications"
On page 5, line 5, delete "Each communication shall
SB 1268 (Simitian)
Page 11 of ?
contain a clear and conspicuous notice and instructions to
the subscriber regarding the process for terminating any
future communication about a transportation-related product
or service."
SB 1268 (Simitian)
Page 12 of ?
c. Transportation-related products and services
As noted above, this bill would allow a transportation agency
to communicate exclusively with its subscribers about its
transportation-related products and services "on behalf of
itself or the agency with which it contracts" through a
contracted third-party. This language is intended to capture
instances where an agency wishes to inform subscribers about
products and services regarding toll collection, such as a new
manner for payment. The author has agreed to amend the bill
to make clear that the communications sent by the
transportation agency relate to products and services that are
offered by the agency in relation to the electronic toll
system.
Suggested amendment:
On page 4, line 40, delete "transportation" and insert
"toll"
On page 5, line 1, strike "on behalf of" and insert "offered
by"
On page 5, line 8, delete "transportation" and insert "toll"
5. Penalties
This bill would permit a person whose personally identifiable
information has been knowingly sold or otherwise provided in
violation of the bill to bring an action to recover either
actual damages or $2,500 for each individual violation,
whichever is greater, and reasonable costs and attorney's fees.
As introduced, this bill would have also provided for penalties
in the case where a transportation agency knowingly sold or
otherwise provided a person's personally identifiable
information three or more times in violation of the bill.
Although this provision was intended to contain graduated
penalties, it did not and the most recent amendments to the bill
delete this section. Graduated penalty structures help to
encourage compliance and provide a deterrent to violations. It
is arguably appropriate to include a graduated penalty structure
in this instance where transportation agencies using electronic
toll collection systems hold significant personal information
about motorists, including location information. As a result,
the author has agreed to amend the bill so that this provision
is reinserted and the penalties for three or more violations be
SB 1268 (Simitian)
Page 13 of ?
increased to $4,000.
Suggested amendment:
On page 6, on line 15 insert "(2) A person whose personally
identifiable information has been knowingly sold or otherwise
provided three or more times in violation of this section may
bring an action to recover either actual damages or four
thousand dollars ($4,000) for each individual violation,
whichever is greater, and may also recover reasonable costs
and attorney's fees."
6. Personally identifiable information may be disclosed pursuant
to a search warrant
Under this bill, a transportation agency may only make
personally identifiable information available to a law
enforcement agency pursuant to a search warrant. A peace
officer who is conducting a criminal or traffic collision
investigation could obtain an individual's personally
identifiable information if the officer has good cause to
believe that a delay in obtaining the information by seeking a
search warrant would result in imminent danger to the health or
safety of a member of the public. In both cases, notice must be
provided to the individual "immediately, but not more than 15
days." A 15-day timeframe is arguably too lengthy and so the
author has agreed to amend the bill to require that notification
be given immediately, but in no event within more than five
days. In addition, amendments are necessary to tighten up the
search warrant provision.
Suggested amendment:
On page 3, line 24, after "may" insert "only"
On page 3, line 28, strike "not more than 15 days" and insert
"in no event within more than five days"
On page 4, line 8, strike "within no more than 15 days" and
insert "but in no event within more than five days"
7. Interaction with existing agreements
This bill would require a transportation agency to take every
effort, within practical business and cost constraints, to purge
personal account information within 60 days after the date the
SB 1268 (Simitian)
Page 14 of ?
account is closed or terminated. This bill would provide that
in no case may a transportation agency maintain personal
information more than 150 days after an account is closed or
terminated. Some transportation agencies have raised concerns
about the proscriptions on data retention contained in this
bill. For example, according to the Orange County
Transportation Authority, as a result of a lawsuit, it and the
Transportation Corridor Agencies are required to retain
information for five years. The author's office notes, however
that the five-year retention requirement appears to apply to
documents, not data and only to those documents relating to toll
violations, not non-violators.
8. Suggested technical and clarifying amendments
The author has agreed to the following amendments to clarify the
language of the bill:
On page 2, line 28, after "to," insert "a description of"
Support : American Civil Liberties Union; Electronic Frontier
Foundation; Privacy Rights Clearinghouse
Opposition : None Known
HISTORY
Source : Author
Related Pending Legislation : None Known
Prior Legislation : AB 198 (Nation, 2003), which was
substantially similar to this bill, was gutted and amended to
deal with an unrelated subject matter.
Prior Vote : Senate Transportation and Housing Committee (Ayes
8, Noes, 0)
**************