Calif. Law Seeks to Avert Privacy Intrusions Related to RFID Toll Tags

In Northern California, FasTrak tags are also read in order to gauge the speed of traffic. This information is utilized to show drivers their expected travel time from point A to point B. This is conveyed trough electronic signage mounted along the highways, as well as via traffic maps posted online at the 511.org Web site. But Randy Rentschler, Bay Area Toll Authority's director of public affairs, explains that the RFID readers used to determine traffic flow encrypt the FasTrak ID numbers they collect, noting that the 511 system does not have access to the personally identifiable data collected by toll agencies. Additionally, the 511 system purges all encrypted numbers at the end of each day.

The Bay Area Toll Authority manages the administration of the tolling system on the seven state-owned bridges spanning the San Francisco Bay (the Golden Gate Bridge, Highway and Transportation District, which also employs FasTrak for toll collection, owns the Golden Gate Bridge).

"We do not have any problem with this piece of legislation," Rentschler says in regard to SB 1268. "Privacy and customer service are our two priorities, and we want to err on the side of privacy." However, he notes, if the bill passes, BATA would need to purge the information it has stored on closed accounts. "In the past, we have not destroyed data. We archived it, simply because it was easier to close and leave than to have a process to destroy it. Plus, by storing it, people were able to later reopen the account."

The San Joaquin Hills and Foothill/Eastern agencies are neutral on the bill in its current form, says Barbara Daly, the government affairs manager for the TCA. "We opposed the bill initially, because it called for destroying account data 60 days after an account was closed," she states, explaining that it sometimes takes more than that amount of time to collect late payments after an account has been closed.

The two TCA members will also need to revise their privacy statements in order to clarify how they will handle personally identifiable data, Daly says, but this is something they were planning to do anyway.