Albany measure seeks to protect commuters' personal data

ALBANY — A proposal in Albany seeks to protect the data of commuters and their travels from public scrutiny, identity thieves, merchants, scammers and even from government itself.

The data is collected in a fleeting second as vehicles transmit personal data to toll collection agencies through programs such as E-ZPass and MetroCard. The data includes addresses, phone numbers, the days and places they’ve traveled on the Thruway and bridges and tunnels, as well as the description and license number of their vehicle. Some data also records when account holders add or delete spouses from their accounts.

Under the proposal, this electronic toll and fare information couldn’t be released under civil or criminal discovery processes or the Freedom of Information Law. Releasing the data to law enforcement would require a search warrant or subpoena approved by a judge. A court order also would have to demonstrate “reasonable cause” that the data would show that a crime was committed.

Releasing this data to someone not entitled to the information under the law could bring a civil penalty of up to $5,000.

“I think people with nefarious reasons try to get peoples’ E-ZPass and other records,” said the bill’s co-sponsor, Assemb. Linda Rosenthal (D-Manhattan). “They want to find out something that they shouldn’t know or for their own reasons. But it’s a person’s private reasons where they travel.

“Now, the fact is that everyone uses E-ZPass,” Rosenthal added. “And there’s a greater likelihood people could be tracked down.”

E-ZPass is used far more now because staffed toll booths have been removed and replaced with electronic tolling.

The Assembly passed the bill 99-48 on Tuesday, and it is now in the State Senate’s powerful Codes Committee, which could send it to a floor vote. The legislative session is scheduled to end June 8.

These government records “open you up to a lot of disclosures,” said Sen. Luis R. Sepúlveda (D-Bronx), the Senate co-sponsor. “I believe a lot of people would be horrified.”

Sepulveda acknowledged that agencies have their own policies and practice to limit access to such information, but that doesn’t carry the strength of law that he said is needed to protect such sensitive information.

The measure has stalled in the Senate in past sessions over concerns that it wasn't needed, but it's unclear if there is continued opposition to the idea.

State agencies such as the Thruway Authority declined to comment on the legislation, A spokesman for the state Association of Chiefs of Police didn’t respond to a request for comment.

Sepulveda said he’s hopeful the bill will pass now that so many more New Yorkers use E-ZPass. “The biggest thrust of this is privacy,” he said. “I certainly don’t want the government or law enforcement to know my every move.”

The New York Civil Liberties Union found his concern had a real-world basis as far back as 2015.

The NYCLU conducted a study that found E-ZPass readers were collecting data well beyond toll booths. The study used a device that showed that a vehicle’s E-ZPass transponder was being read even when it wasn't in a toll area. The state said this was being done only for traffic studies.

“The concerns are the same,” said Daniel Schwarz, senior privacy and technology strategist at the NYCLU. “All these centralized data collections, when collecting over time and over a large area, can reveal sensitive information about peoples’ movement such as their place of worship and whether they attended protests.”

The use of transponders and license plate readers would increase under the proposed congestion pricing plan for Manhattan, which would track and bill customers in the most congested parts of the area, he said.

Some don’t believe the bill goes far enough.

“E-ZPass and other transit data can be used to track New Yorkers traveling to mosques, protests, abortion clinics, and other sensitive sites,” said Will Owen of the privacy advocate Surveillance Technology Oversight Project, or STOP, based in Manhattan. “This legislation is a crucial first step toward protecting the data of drivers and commuters, but its penalties for violating the law are absurdly low.”

The state Thruway Authority and Port Authority of New York and New Jersey have their own privacy policies, but officials declined to comment on pending legislation. The Metropolitan Transportation Authority also declined to comment.

Under its policy, the Port Authority can only release data to account holders and their lawyers; other transit agencies “for the limited purpose of effectuating payment,” by subpoena or court order in a criminal case; or in an “administrative proceeding related to a violation of toll collection laws and regulations,” said Lenis Valens, of the authority.

“We specifically are prohibited from sharing electronic tolling information with third parties outside of these limited circumstances or using such information for commercial or other purposes not directly related to the business of the Port Authority in operating its bridge and tunnel facilities,” Valens said.

Further, the state Office of Information Technology Services states that in addition to state and federal privacy laws, the state limits access to data to “employees who need access to the information” for their job. The agency also has safeguards to protect data, including encryption.

As for the state Freedom of Information Law, “data and images” from electronic toll records already appear to be exempt from FOIL, said Diane Kennedy, of the New York News Publishers Association, citing state public officers’ law.

Nationally, E-ZPass is operated in 18 states, including New York. Privacy concerns have risen in some states, including in Florida, over the ability of police to track vehicles through what often have been called “hot lists.”

The Massachusetts Civil Liberties Union said E-ZPass technology allowed automatic notification to police when specific license plates or E-ZPass transponders pass through monitors. Massachusetts officials, however, said the feature was only to be used for emergencies such as Amber Alerts about missing or abducted people.

Concern over release of commuters’ data is part of a larger concern over government holding personal data, said Schwarz, of the NYCLU.

“Over the last few years, privacy has been negated and really an afterthought,” Schwarz said. “We need rigorous guard rails and protections to protect peoples’ privacy and civil rights.”

By Michael Gormley

michael.gormley@newsday.com@GormleyAlbany

Michael Gormley has worked for Newsday since 2013, covering state government, politics and issues. He has covered Albany since 2001.