California Assembly Bill AB539 Latest Draft

 BILL NUMBER: AB 539AMENDED BILL TEXT AMENDED IN SENATE JUNE 27, 2012 AMENDED IN SENATE JUNE 13, 2012 AMENDED IN ASSEMBLY APRIL 25, 2011 AMENDED IN ASSEMBLY APRIL 5, 2011 INTRODUCED BY Assembly Member Williams  (   Coauthor:   Assembly Member   Achadjian   )  FEBRUARY 16, 2011 An act to amend Section 31490 of the Streets and Highways Code, relating to transportation. LEGISLATIVE COUNSEL'S DIGEST AB 539, as amended, Williams. Electronic toll collection systems: information use. Existing law authorizes the development and implementation of various electronic bridge and highway toll collection mechanisms. Existing law prohibits a transportation agency, as defined, from selling or providing personally identifiable information of a person obtained pursuant to the person's participation in an electronic toll collection system or use of a toll facility that uses an electronic toll collection system, subject to specified exceptions. Existing law requires a transportation agency that uses an electronic toll collection system to establish a privacy policy regarding the collection and storage of personally identifiable information in that regard, to provide the policy to subscribers, and to post the policy on its Internet Web site. Existing law permits a transportation agency to share data collected via an electronic toll collection system with another transportation agency solely to comply with interoperablility specifications and standards for electronic toll collection devices. Existing law also permits a transportation agency to perform billing and other financial functions necessary to operate and manage toll facilities. This bill would permit a transportation agency or its designee to share  license plate and other specified  data regarding a vehicle's use of toll facilities with  an entity operating a toll facility   another transportation agency  , whether in the state or not, solely to comply with the above specifications and standards.  This bill would also permit a transportation agency to share specified information with transportation agencies in other states as part of a nationwide interoperability toll collection program.  This bill would also permit a transportation agency to perform toll collection and violation enforcement functions required to operate and manage toll facilities, whether in the state or not. Vote: majority. Appropriation: no. Fiscal committee: no. State-mandated local program: no. THE PEOPLE OF THE STATE OF CALIFORNIA DO ENACT AS FOLLOWS: SECTION 1. Section 31490 of the Streets and Highways Code is amended to read: 31490. (a) Except as otherwise provided in this section, a transportation agency may not sell or otherwise provide to any other person or entity personally identifiable information of any person who subscribes to an electronic toll collection system or who uses a toll bridge, toll lane, or toll highway that employs an electronic toll collection system. (b) A transportation agency that employs an electronic toll collection system shall establish a privacy policy regarding the collection and use of personally identifiable information and provide to subscribers of that system a copy of the privacy policy in a manner that is conspicuous and meaningful, such as by providing a copy to the subscriber with the transponder or other device used as an electronic toll collection mechanism, or, if the system does not use a mechanism, with the application materials. A transportation agency shall conspicuously post its privacy policy on its Internet Web site. For purposes of this subdivision, "conspicuously post" has the same meaning as that term is defined in paragraphs (1) to (4), inclusive, of subdivision (b) of Section 22577 of the Business and Professions Code. The policy shall include, but need not be limited to, a description of the following: (1) The types of personally identifiable information that is collected by the agency. (2) The categories of third-party persons or entities with whom the agency may share personally identifiable information. (3) The process by which a transportation agency notifies subscribers of material changes to its privacy policy. (4) The effective date of the privacy policy. (5) The process by which a subscriber may review and request changes to any of his or her personally identifiable information. (c) A transportation agency may, within practical business and cost constraints, store only personally identifiable information of a person such as the account name, credit card number, billing address, vehicle information, and other basic account information required to perform account functions such as billing, account settlement, or enforcement activities. All other information, on and after July 1, 2011, shall be discarded no more than four years and six months after the closure date of the billing cycle and the bill has been paid and all toll violations, if applicable, have been resolved. (d) On and after July 1, 2011, a transportation agency shall take every effort, within practical business and cost constraints, to purge the personal account information of an account that is closed or terminated. In no case shall a transportation agency maintain personal information more than four years and six months after the date an account is closed or terminated. (e) (1) A transportation agency may make personally identifiable information of a person available to a law enforcement agency only pursuant to a search warrant. Absent a provision in the search warrant to the contrary, the law enforcement agency shall immediately, but in any event within no more than five days, notify the person that his or her records have been obtained and shall provide the person with a copy of the search warrant and the identity of the law enforcement agency or peace officer to whom the records were provided. (2) This section does not prohibit a peace officer, as defined in Section 830.1 or 830.2 of the Penal Code, when conducting a criminal or traffic collision investigation, from obtaining personally identifiable information of a person if the officer has good cause to believe that a delay in obtaining this information by seeking a search warrant would cause an adverse result, as defined in paragraph (2) of subdivision (a) of Section 1524.2 of the Penal Code. (f) This section does not prohibit a transportation agency in subdivision (a) from providing aggregated traveler information derived from collective data that relates to a group or category of persons from which personally identifiable information has been removed. (g) This section does not prohibit a transportation agency from providing the license plate number of an intermodal chassis to the owner of the chassis for purposes of locating the driver of the chassis in the event the driver fails to pay the toll. (h)  (1)    This section does not prohibit a transportation agency from sharing  license plate information and other data regarding a vehicle's use of toll facilities with any entity operating a toll bridge, toll lane, or toll highway, whether in the state or not,   data   with another transportation agency  solely to comply with interoperability specifications and standards adopted pursuant to Section 27565 regarding electronic toll collection devices and technologies.  A third-party vendor may not use personally identifiable information obtained under this subdivision for a purpose other than described in this subdivision.   (2) This section does not prohibit a transportation agency from participating in a nationwide interoperability program with toll collection agencies in other states, to which the agency provides only the following information regarding a vehicle's use of the toll facility:   (A) License plate number.   (B) Transponder identification number.   (C) Date and time of transaction.   (D) Identity of the agency operating the toll facility.   (3) A third-party vendor may not use personally identifiable information obtained under this subdivision for a purpose other than described in this subdivision.  (i) This section shall not prohibit a transportation agency, or its designee, from performing financial and accounting functions such as billing, account settlement, toll collection, violation enforcement, or other financial activities required to operate and manage the toll facilities, whether in the state or not. (j) This section does not prohibit a transportation agency from communicating about products and services offered by itself, a business partner, or the agency with which it contracts to subscribers of the transportation agency through a contracted third-party vendor using personally identifiable information limited to the subscriber's name, address, and electronic mail address, provided that, for customer agreements entered into on or after January 1, 2011, the transportation agency has received the subscriber's express written consent to receive the communications. (k) A transportation agency may not use a nonsubscriber's personally identifiable information obtained using an electronic toll collection system to market products or services to that nonsubscriber. This subdivision shall not apply to toll-related products or services contained in a notice of toll evasion issued pursuant to Section 23302 of the Vehicle Code. (l) For purposes of this section, "transportation agency" means the Department of Transportation, the Bay Area Toll Authority, any entity operating a toll bridge, toll lane, or toll highway within the state, or any entity under contract with any of the above entities. (m) For purposes of this section, "electronic toll collection system" is a system where a transponder, camera-based vehicle identification system, or other electronic medium is used to deduct payment of a toll from a subscriber's account or to establish an obligation to pay a toll. (n) For purposes of this section, "person" means any person who subscribes to an electronic toll collection system or any person who uses a toll bridge, toll lane, or toll road that employs an electronic toll collection system. (o) For purposes of this section, "personally identifiable information" means any information that identifies or describes a person including, but not limited to, travel pattern data, address, telephone number, e-mail address, license plate number, photograph, bank account information, or credit card number. (p) (1) In addition to any other remedies provided by law, a person whose personally identifiable information has been knowingly sold or otherwise provided in violation of this section may bring an action to recover either actual damages or two thousand five hundred dollars ($2,500) for each individual violation, whichever is greater, and may also recover reasonable costs and attorney's fees. (2) A person whose personally identifiable information has been knowingly sold or otherwise provided three or more times in violation of this section may bring an action to recover either actual damages or four thousand dollars ($4,000) for each individual violation, whichever is greater, and may also recover reasonable costs and attorney's fees. (q) Nothing in subdivisions (c) and (d) shall preclude compliance with a court order or settlement agreement that has been approved on or before April 25, 2010. (r) A transportation agency that employs an electronic toll collection system may impose an administrative fee on persons who use that system in an amount sufficient to cover the cost of implementing this section.