From jd@scn.org Sun May 16 15:11:42 1999 Date: Mon, 10 May 1999 15:16:44 -0700 (PDT) From: SCN User To: local-computer-activists@scn.org Subject: SSB 5064 - Privacy & transportation smart cards May 9, 1999 Governor Gary Locke Via Fax: 360-753-4110 Re: SSB 5064 -- Public Transportation Information Dear Governor Locke, The Seattle chapter of Computer Professionals for Social Responsibility asks you to veto SSB 5064, a bill which concerns the confidentiality of public transportation information. Rather than truly protecting privacy or confidentiality, we believe it leads our state toward more unnecessary personal data collection. CPSR is a national alliance of computer professionals concerned about the impact of computer technology on society. Privacy is important to us, so we appreciate the attention you have brought to privacy matters, including the conference held in Seattle in the fall of 1997. We strongly agree with Allied Daily Newspapers that the best way to protect the privacy of individual travel information is not to collect it. We favor the use of anonymous pass systems, such as those successfully used in San Francisco, Chicago and Washington, D.C., as a simple way to protect privacy, streamline government, minimize targeted junk mail, and gain the trust of the public. Promoting this approach should be the policy of the State of Washington. Such a simple, prudent approach would eliminate the need for most of this bill. If transportation companies are worried about liability caused by the release of personal information, nothing could protect them better than an anonymous pass system. Such a system would provide trip information useful in planning routes and serving customers without identifying individuals. By contrast, proposing new transportation smart cards based on known individuals only guarantees endless debate over who should have access to what information about them. What exactly are "billing purposes?" (Section 2) Do they include various administrative uses after the card is sold, or do they end at the point of sale? How will lost cards be handled? In the Bay Area, anonymous fare pass users have the option of writing their name and address on the card after they buy it to assist in returning a lost card -- opt-in instead of opt-out. Yes, the bill hearings did include some discussion of individuals being able to choose a "John Doe" pass, but such a right is not guaranteed in current law, nor is it found in this bill. Particularly where employers, schools, or government agencies help subsidize travel, it is questionable whether individuals would actually have free choice. (The area of health insurance provides a related example: many employees have been forced to use Social Security numbers as medical identifiers by their employer, not their health insurance company.) In the absence of such a guarantee, how would transportation services bill the accounts of individual smart card holders, without somehow tracking their movement (e.g., date/time of each toll bridge crossing)? How much of the resulting data/billing records would ultimately be available to others? What individuals or groups could access the raw data to compile reports? Section 2 restricts the use of personally identifiable information by providers of transportation services, but it is not as clear how others will be affected. Section 2 lacks clear language, such as, "No person may...." Overall, the section strikes us as unworkable and vague. Section 2 also permits statistical compilations and reports "that do not identify an individual", rather than those "from which an individual cannot be identified." Section 1 (nn) protects "personally identifying", rather than "personally identifiable" information. "Identify" and "identifiable" sound similar -- but under the language in the bill your name, address, transit route or travel patterns might not be listed in a report, but still be deducible if the report is paired with other available information. Employers, schools, and any government agencies subsidizing transit passes or agencies concerned with public safety are also free to request identifying information (Section 1 (nn)). This is not what most people think of as privacy. Finally, we do not support granting news media special access to personal information, apart from public access (Section 1(nn)). Rather than modifying the public disclosure laws, we believe, again, that the best technical solution and the wisest public policy is the use of anonymous fare passes -- a policy which the press, itself, supports. Relying on SSB 5064 to protect privacy in future transportation billing systems is wishful thinking. Section 1(nn) is highly inadequate, while Section 2 is unworkable and vague. The future of electronic commerce rests with consumer trust. We urge you to veto SSB 5064. Sincerely, Janeane Dubuar Computer Professionals for Social Responsibility Seattle Chapter * * * * * * * * * * * * * * From the Listowner * * * * * * * * * * * * . To unsubscribe from this list, send a message to: majordomo@scn.org In the body of the message, type: unsubscribe local-computer-activists END