Liability of Transportation Entity for the Unintentional Release of Secure Data or the Intentional Release of Monitoring Data on Movements or Activities of the Public (2016)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

7As for the kinds of monitoring data transporta- tion agencies are collecting and/or maintaining,41 they reported collecting data on accidents,42 driver behavior,43 license plate numbers,44 tolls and toll road data,45 traffic counts,46 traffic volume,47 vehicle classification,48 vehicle occupancy,49 vehicle speed,50 and Wi-Fi and Bluetooth media access control (MAC) addresses accessed along Interstate routes without, however, storing the data.51 The Missouri Highways and Transportation Department (MoDOT) stated that it “collects traffic count and turning movement information at inter- sections throughout the state. These counts can be collected manually by staff in the field or they may be captured using video that is later processed.” The department provided a copy of the contract that it has with one company to receive a live traffic data feed for thousands of roadway miles in Missouri. This data is collected, processed, and dis- tributed solely by [HERE North America, LLC (HERE)]. MoDOT is simply a recipient of the data feed. The data received by MoDOT include[] the average speed and travel time for pre-defined roadway segments at approximately 60-second intervals. This data feed has allowed MoDOT to monitor live traffic conditions on thousands of miles of road- ways without the need for instrumentation such as is used in St. Louis and Kansas City.52 The department stated that although MoDOT uses closed-circuit television cameras to monitor live traffic conditions, the images captured by the cameras are not recorded or stored.53 Appendix B provides more details on the types of secure and monitoring data that the agencies reported that they are collecting. II. TRANSPORTATION AGENCIES’ USE OF ITS TO COLLECT DATA A. Legal Authority for ITS Congress enacted the Intelligent Transportation Systems Act as part of the Transportation Equity Act for the 21st Century (TEA-21) of 1998.54 Con- gress decided that the investments authorized by the Intermodal Surface Transportation Efficiency Act of 199155 demonstrated that ITS “can mitigate surface transportation problems in a cost-effective manner.”56 Congress also decided that continued investment in ITS was needed to accelerate the incorporation of ITS into the national surface trans- portation network to improve transportation safety and efficiency and reduce costs and “impacts on communities and the environment.”57 Congress directed the Secretary of Transportation to “develop, implement, and maintain a national architecture and supporting standards and protocols to promote the widespread use and evaluation” of ITS technol- ogy in the surface transportation systems of the United States and to promote ITS to the “maximum extent practicable.”58 Section 5208 of TEA-21 cre- ated the Intelligent Transportation System Integra- tion Program.59 ITS is codified in 23 U.S.C. § 501. Section 501(5) defines the term “ITS” as “electronics, photonics, communications, or information processing used singly or in combination to improve the efficiency or safety of a surface transportation system.”60 Sec- tion 502 encourages the Secretary of Transporta- tion to make decisions needed on the research, development, and technology for the implementa- tion of intelligent transportation infrastructure.61 Section 501(4) defines intelligent transportation architecture as “fully integrated public sector intel- ligent transportation system components, as defined by the Secretary….”62 In implementing ITS programs, the secretary is obligated to cooperate with other governmental entities and private or educational entities.63 Moreover, the secretary was directed to establish an Advisory Committee com- posed of relevant stakeholders to oversee the implementation of ITS programs.64 41 See Appendix A. 42 Arizona DOT, District of Columbia DOT (crash infor- mation), and South Carolina DOT. 43 Arkansas DOT. 44 Arkansas DOT and Oregon DOT. 45 Indiana DOT. 46 Alabama DOT and MoDOT. 47 Florida DOT and MoDOT. 48 Arkansas DOT and MoDOT. 49 Arkansas DOT. 50 Alabama DOT, Arizona DOT, Florida DOT, and MoDOT. 51 Indiana DOT. 52 See Appendix B. 53 The Utah DOT also reported that it uses real-time images from CCTV cameras without recording the images. 54 Pub. L. No. 105-178, §§ 5201–5207, 112 Stat. 457 (1998). 55 Pub. L. No. 102-240, 105 Stat. 1914. 56 Pub. L. No. 105-178, § 5202. See 23 U.S.C. § 514(a) (2015). 57 Id. 58 Pub. L. No. 105-178, § 5206(a), 112 Stat. 457 (1998). 59 Pub. L. No. 105-178, § 5208, 112 Stat. 457 (1998). 60 23 U.S.C. § 501(5) (2015). 61 23 U.S.C. § 502 (2015). 62 23 U.S.C. § 501(4) (2015). 63 23 U.S.C. §§ 515(a)-(c) (2015). 64 23 U.S.C. § 515(h) (2015). The Advisory Committee must have no more than 20 members, balanced between metropolitan and rural interests, and include a represen- tative of the agencies, disciplines, and groups identified in §§ 515(h)(2)(A)-(L).

8Section 503 outlines the objectives for research and technology that may be used, such as for active traffic and demand management, emer- gency operations, real-time transportation infor- mation, and impact of vehicle size and weight on congestion and on enhanced mode choice and intermodal connectivity.65 Research is to be com- prehensive and include “operational tests of intel- ligent vehicles, intelligent infrastructure systems, and other similar activities that are necessary to carry out this chapter.”66 The secretary is expected to prioritize funding for projects that focus on improved traffic management, environmental impacts, and crash avoidance. The federal government may provide not more than 80 percent of a project’s funding when the project comes within one of the categories enumerated in 23 U.S.C. § 502(3).67 ITS is to be implemented for passenger and freight transportation by all forms of surface transportation to meet the above goals.68 B. Traffic Monitoring Systems Federal regulations promulgated pursuant to 23 U.S.C. § 303 provide for the establishment in each state of a traffic monitoring system (TMS) for high- ways and public transportation facilities and equip- ment. The term “TMS” is defined as “a systematic process for the collection, analysis, summary, and retention of highway and transit related person and vehicular traffic data.”69 A state is to use TMS data when providing data to the U.S. Department of Transportation (USDOT); when the data are used to support transportation management systems or studies or systems that are the USDOT’s responsibility; when the collec- tion of data is supported by federal funding pro- vided by USDOT programs; when the data are used in the apportionment or allocation of federal funds by the USDOT; when the data are used in the design or construction of a project funded by the Federal Highway Administration (FHWA); or when data are required as part of a federally mandated USDOT program.70 C. Electronic Toll Collection Electronic toll collection is defined as “the ability for vehicle operators to pay tolls automatically without slowing down from normal highway speeds.”71 Unless FHWA grants an exception, any toll facility operating under the authority of Section 1604 of the Safe, Accountable, Flexible, Efficient Transportation Equity Act: A Legacy for Users (SAFETEA-LU) must use an electronic sys- tem to collect tolls.72 Because of the breadth of the information col- lected by electronic tolling facilities, the regulations include a section on privacy: A toll agency using electronic toll collection technology must develop, implement, and make publicly available pri- vacy policies to safeguard the disclosure of any data that may be collected through such technology concerning any user of a toll facility operating pursuant to authority under a 1604 toll program, but is not required to submit such poli- cies to FHWA for approval.73 California law that governs electronic toll collec- tion permits the collection of PII, including credit card numbers and billing addresses,74 but requires that the transportation provider post its privacy policy clearly on its Web site.75 Pennsylvania law governs the privacy of an account holder’s information for electronic toll col- lection. Under the statute, except for limited excep- tions (e.g., criminal law enforcement actions or the enforcement of toll collection laws), toll collection information shall not be deemed a public record under the Right-to-Know Law, nor shall it be discoverable by court order or otherwise or be offered in evidence in any action or proceeding which is not directly related to the discharge of duties under this section, the regulations of the commission or a violation of an account holder agreement.76 New York, besides defining electronic toll collec- tion and the methods used to obtain data, mandates that public data must be protected and that each department must have a privacy compliance offi- cer.77 The compliance officer is responsible for main- taining records of personal data that are collected and for assisting individuals in gaining access to information when it is requested.78 Toll operators in Virginia may not sell or disclose “data to any entity other than for toll collection purposes.”79 71 23 C.F.R. § 950.3 (2015). 72 23 C.F.R. § 950.1 (2015). 73 23 C.F.R. § 950.5(c) (2015). 74 caL. sTs. & high. cOde § 31490 (2015). 75 caL. sTs. & high. cOde §§ 31490(b) and (c) (2015). 76 74 pa. cONs. sTaT. § 8117(d)(1)(ii) (2015). See also 74 pa. cONs. sTaT. § 8117(d)(2)(1) and (iii) (2015). 77 N.Y. UNcONsOL. LaW §§ 6816-b (h)-(j) (2015). 78 N.Y. cOMp. cOdes R. & Regs. tit. 17, §§ 2.3 (b)(2) and (4)(i) (2015). 79 Phillips and Kohm, supra note 1, at P30. 65 23 U.S.C. § 503 (2015) (terms not defined). 66 23 U.S.C. § 516(a) (2015). 67 23 U.S.C. § 516(c) (2015). 68 23 U.S.C. § 514(b) (2015). 69 23 C.F.R. § 500.202 (2015). 70 23 C.F.R. § 500.203 (2015).