BILL ANALYSIS
SB 1268
Page 1
Date of Hearing: June 29, 2010
ASSEMBLY COMMITTEE ON JUDICIARY
Mike Feuer, Chair
SB 1268 (Simitian) - As Amended: May 28, 2010
As Proposed to be Amended
SENATE VOTE : 24-10
SUBJECT : Electronic Toll Collection: Personal Information
KEY ISSUES :
1)Should a transportation agency that collects a customer's
personal information through an automated toll collection
system be prohibited from selling or providing that
information to other persons or entities?
2)Should a transportation agency that collects a customer's
personal information through an automated toll collection
system be required to purge that information periodically?
FISCAL EFFECT : As currently in print this bill is keyed fiscal.
SYNOPSIS
This measure is a response to the increasing use of electronic
toll collections systems such as FasTrak. Under those systems,
the subscriber's vehicle contains a tag that is read
electronically and the subscriber is subsequently billed for
each pass through. Using the Fastrak lanes allows the
subscriber to avoid often long lines in the non-automated lanes.
The transportation agencies that offer this service must
necessarily collect personal information from subscribers,
including name, address, and often a credit card number, for
purposes of billing. This bill seeks to protect the privacy of
the personal information, primarily, by (1) prohibiting agencies
from selling or otherwise sharing data with third parties,
subject to certain exceptions; and (2) requiring the agencies to
regularly purge that information within fours years and six
months of account closure, as specified. The bill permits a
transportation agency to communicate with subscribers about
other services that it may offer, but only if the subscriber
"opts in" and agrees to receive such communications in writing.
SB 1268
Page 2
Finally, the bill authorizes the agencies to impose a fee to
cover the costs of complying with the bill's provisions. The
bill is supported by privacy rights and consumer groups. The
bill was initially opposed by several local transportation
authorities unless the time frame for purging data was expanded
to match the statute of limitations under which consumers could
challenge charges and penalties. The author agreed to take this
amendment - and one other clarifying the prospective nature of
the communication opt-in - in the Assembly Transportation
Committee. Because of time constraints the author will take
those agreed-upon amendments in this Committee. The following
analysis reflects those amendments.
SUMMARY : Requires a transportation agency that operates an
automated toll collection system to regularly purge personal
account information and prohibits the agency from selling or
providing that personal information to other persons or
entities, except as provided. Specifically, this bill :
1)Provides that a transportation agency shall not sell or
provide to any other person or entity the personally
identifiable information of any person who subscribes to an
electronic toll collection system, as defined.
2)Requires a transportation agency that operates an electronic
toll collection system to establish a privacy policy regarding
the collection and use of personally identifiable information,
to provide customers with a copy of that policy, and to
conspicuously post that policy on an Internet Web site.
3)Provides that a transportation agency may only store the kinds
of personally identifiable information that are essential to
perform account functions such as billing, account settlement,
and enforcement.
4)Provides that on or after July 1, 2011, the transportation
agency that operates an electronic toll collection system
shall take every effort, within practical business and cost
constraints, to purge personal account information no earlier
than four years and not later than four years and six months
after the date on which the person's account is closed and all
toll violations, if applicable, have been resolved.
5)Permits a transportation agency to make personally
identifiable information available to law enforcement agency
SB 1268
Page 3
pursuant to a search warrant, or to peace officer to prevent
an imminent danger. Specifies that a transportation agency
may also share personal account information with other
agencies in order to facilitate interoperability among
different toll collection systems.
6)Specifies that, for agreements entered into after January
1,2011, a transportation agency may communicate with customers
about other products and services offered by the agency or its
business partners, so long as the subscriber "opts in" by
providing prior written consent to receive such
communications.
7)Provides that, in addition to any other remedy provided by
law, a person whose account information has been knowingly
sold or provided to another person or entity in violation of
the terms of this bill, may bring an action to recover actual
damages or statutory amounts, as specified.
8)Permits a transportation agency that operates an electronic
toll collection system to impose an administrative fee on
persons who use the system in an amount sufficient to cover
the cost of implementing the provisions of this bill.
EXISTING LAW :
1)Provides, under the Information Practices Act (IPA), that an
individual's name and address may not be distributed for
commercial purposes, sold, or rented by an agency unless such
action is specifically authorized by law. The IPA applies to
state agencies such as Caltrans, but does not apply to
transportation agencies or other local entities. (Civil Code
Sections 1798 et seq.)
2)Provides that Caltrans has exclusive jurisdiction to grant
franchises, privileges, or licenses for the construction or
operation of toll bridges, toll roads, and toll ferries and
for the taking and keeping of tolls from the bridges, roads,
and ferries situated wholly or in part within the state.
(Streets & Highway Code Section 30800.)
3)Permits Caltrans to establish toll rates and to make orders
and prescribe rules and regulations concerning toll roads,
toll bridges, or toll ferries. (Streets & Highway Codes
Sections 30803, 30807.)
SB 1268
Page 4
4)Permits the use of automatic vehicle identification systems
for toll collection. (Streets & Highways Code Section 27564.)
COMMENTS : According to the author, this bill will protect the
privacy of California drivers who make use of automated toll
collection systems like Fastrak. With an electronic toll
collection system, motorists can avoid the longer lines at
manual toll collection booths by going through an automated lane
with an electronic reading device. The subscriber's automobile
contains a transponder containing a number that is read by an
electronic reader as the vehicle passes through the booth. This
information is then linked to a database with the subscriber's
name, address, and credit card number for billing purposes.
This bill seeks to protect the privacy of the personal
information that is collected by transportation agencies. The
bill contains two major provisions. First, the bill prohibits
agencies from sharing, selling, or otherwise disclosing any of
the subscriber's personally identifiable information to third
parties. CALTRANS, as a state agency covered by the Information
Practices Act (IPA), is already subject to such limitations;
however, the IPA does not cover local transportation
authorities. The bill generally permits the release of the
information to other transportation agencies in order to allow
for interoperability of the systems, and it also permits release
of the information pursuant to a search warrant or to a peace
officer if the information is necessary to prevent an imminent
danger. Second, the bill requires the transportation agencies
to purge the information periodically. Originally, this bill
required information to be purged if possible within 60 days
after the closing of an account and, in any event, not later
than 150 days after the closing of the account. For reasons
discussed below, the author has agreed to extend this purge
period to four years and six months after the closing of an
account and the resolution of any disputed charges.
In addition, the bill specifies that a transportation agency may
communicate with its subscribers about other services that it
may offer so long as the customer agrees to this in writing in
advance. This "opt in" requirement is prospective only,
applying only to agreements entered into after January 1, 2011.
Many of the existing agreements have "opt out" provisions - that
is the customer can receive communications unless he or she has
expressly stated a desire not to receive them. Those existing
SB 1268
Page 5
agreements will not be affected. Finally, this bill requires a
transportation agency to develop a privacy policy related to its
use and retention of a subscriber's personal information and
requires the agency to post that privacy policy on its Internet
Web site. The bill authorizes the transportation agencies to
impose a fee to cover any costs incurred by the requirements
created by this bill, such as the need to regularly purge data
according to a specified time frame.
ARGUMENTS IN SUPPORT : This bill is supported by the ACLU and
several privacy rights and consumer protection groups. These
supporters contend that this bill will "provide important
privacy protection for users of electronic toll collection
systems." Supporters claim that, since the inception of
FasTrak, a growing number of "attorneys, law enforcement
agencies, and other entities have been requesting and obtaining
data on FasTrak subscribers and their travel patterns - often
simply by presenting a subpoena." Supporters believe that this
bill will address this problem by only permitting release of
information pursuant to a search warrant or to a peace officer
who attests that the information is necessary to prevent an
imminent danger. Finally, supporters also point out that the
data collected by transportation agencies will create "data-rich
files on all subscribers, which could then be accessed by third
parties without the permission of the subscriber." Supporters
believe this bill will remedy that potential problem by creating
guidelines on data use, retention, and destruction. In
addition, supporters support the provisions of this bill that
give subscribers a right to bring a civil action if their
personally identifiable information is compromised.
OPPOSITION CONCERNS APPARENTLY ADDRESSED BY AMENDMENTS TO BE
TAKEN IN THIS COMMITTEE: The amendments agreed to in the prior
Committee and to be formally taken in this Committee appear to
remove all or most of the opposition. Several local
transportation agencies expressed concern about the need for the
bill and, in particular, the cost and workability of the purge
requirement. Opponents generally did not take issue with the
provisions of this bill that prohibited agencies from selling
personal information, since the agencies claim that they do not
do this and have no intention of doing so in the future.
However, opponents opposed the purge requirements for two
reasons: first, the unknown costs of upgrading computer systems
so that information could be purged on a rolling basis and,
second, the need to retain subscriber data for longer than the
SB 1268
Page 6
time frame initially proposed by the author. Although the cost
concerns are apparently addressed by the authority to charge a
fee, the opponents claim that they need to keep customer data
for at least four years in case a customer challenges any
charges or penalties after the account is closed.
Transportation agencies have, in fact, been sued under the
Unfair Competition Law (Business & Professions Code Section
17200) over contested charges and penalties, and that statute
has a four-year statute of limitations. Although the author
contends the four-year statute of limitations does not apply to
"government entities" (for which a one-year statute of
limitations applies), this is in fact a debatable point. A
recent lawsuit against the Orange County Transportation
Authority suggests that the four year statute of limitations
would in fact apply. Indeed, the settlement in the case
required the agency to maintain the data for five years so that
other subscribers could join the class action and receive
restitution for improper charges or penalties. Had the 60-150
day purge requirement been in place prior to initiation of that
lawsuit, it is possible that plaintiffs would have had no access
to information supportive of their claim. In short, retaining
the data for the period of the statute of limitations does not
only permit the transportation agency to defend itself, it also
protects the plaintiff who may need that data to support a case.
Amendments Agreed to in Assembly Transportation Committee : In
response to the concerns of the opponents, the author agreed in
the Assembly Transportation Committee to accept an amendment
that would align the purge period with the potentially
applicable four-year statute of limitations. Specifically, the
bill will now provide that the data must be purged not sooner
than four years, and not later than four years and six months,
after the closing of an account. This will provide a window
during which the transportation agency can purge the information
of several closed accounts at once, rather than having to purge
continuously on a daily basis as the four-year period is reached
for each individual closed account. In addition, the author
also agreed to clarify that the provision requiring subscribers
to "opt in" by giving written consent to receive written
communications from the agency is prospective only. That is,
for all agreements entered into after January 1, 2011, a
subscriber can only receive such communications if they give
express written consent. Existing agreements have an "opt out"
provision, which requires the subscriber to affirmatively
SB 1268
Page 7
indicate that he or she does not want to receive communications.
In order to effectuate the above agreement, the author has
agreed to take the following amendments in this committee :
- On page 3, line 21, strike "within 60" and strike lines
22 through 24 and insert:
no earlier than four years and not later than four years and six
months after the date on which the person's account is closed
and all toll violations, if applicable, have been resolved.
- On page 4, line 40 after "that" insert:
, for customer agreements entered into on or after January 1,
2011,
REGISTERED SUPPORT / OPPOSITION :
Support
American Civil Liberties Union (ACLU)
Consumer Action
Consumer Federation of California
Electronic Frontier Foundation
Privacy Rights Clearinghouse
Opposition (prior to amendments taken in this Committee)
Orange County Transportation Authority (unless amended)
San Diego Association of Governments (unless amended)
South Bay Expressway (unless amended)
Transportation Corridor Agencies (unless amended)
Analysis Prepared by : Thomas Clark / JUD. / (916) 319-2334