April 2008 TRANSIT COOPERATIVE RESEARCH PROGRAM Sponsored by the Federal Transit Administration Subject Areas: IA Planning and Administration; Responsible Senior Program Officer: Gwen Chisholm Smith IC Transportation Law; VI Public Transit Legal Research Digest 25 PRivacY ISSUES WITH THE USE OF SMART CARDS This report was prepared under TCRP Project J-5, “Legal Aspects of Transit and Intermodal Transportation Programs,” for which the Transportation Research Board is the agency coordinating the research. The report was prepared by Paul Stephen Dempsey, Tomlinson Professor of Law, McGill University, Montreal, Quebec, Canada. James B. McDaniel, TRB Counsel for Legal Research Projects, was the principal investigator and content editor. The Problem and Its Solution fees. Using Smart Cards to replace traditional transit tickets or tokens reduces cash handling, The nation’s transit agencies need to have equipment maintenance, and security costs. access to a program that can provide authori- Smart Cards hold the promise of increasing tatively researched, specific, limited-scope CONTENTS convenience for riders, improving collection of studies of legal issues and problems having I. Introduction 3 ridership data, lending a more modern image to national significance and application to their A. The Potential Uses and transit, and providing new opportunities for in- businesses. The TCRP Project J-5 is designed Abuses of Smart Cards 3 novative fare structures and marketing. to provide this insight. B. Examples of Smart In March 2000, TCRP published Legal Re- Card Utilization 4 The intermodal approach to surface trans- search Digest 14: Treatment of Privacy Issues portation requires a partnership between transit C. Advantages of in the Public Transportation Industry. TCRP Smart Cards 5 and other transportation modes. LRD 14 contains a historic and general over- D. Disadvantages of Transit attorneys have noted that they par- view of privacy in the field of public transporta- Smart Cards 6 ticularly need information in several areas of tion—examining privacy issues associated with II. The Evolution of Concerns transportation law, including environmental re- Over Privacy and Security Since employment, as well as those associated with quirements; construction and procurement con- September 11, 2001 (9/11) 9 customers of public transportation. It also noted tract procedures and administration; civil rights III. Federal Privacy Law 10 the beneficial use of a Smart Card data collec- and labor standards; and tort liability, risk man- A. Constitutional Law 10 tion system to transportation planners. Subse- agement, and system safety. quent to this publication, particularly after the B. Federal Statutes 14 In other areas of the law, transit programs terrorist events of September 11, 2001, public C. Administrative may involve legal problems and issues that are Practice 16 consciousness regarding privacy as it relates to not shared with other modes; as, for example, the use of Smart Cards changed. The plea for a IV. State Privacy Law 17 compliance with transit equipment and opera- higher level of security has supported the rapid A. Constitutional Law 17 tions guidelines, Federal Transit Administra- growth in technological enhancements and uses B. Common Law 17 tion (FTA) financing initiatives, and labor or of the Smart Card. environmental standards. C. Statutory Law 17 This digest examines basic privacy issues as- V. Transit Agencies and Smart sociated with the acquisition and storage of fi- Cards: Policies and Procedures Applications Governing Information, nancial and trip data, including, but not limited Access, and Use 18 Smart Cards are credit card-sized plastic to, who can access the data, what data may be A. Transit ID Cards 18 cards that contain embedded technology en- accessed and under what conditions, and how B. Transit Agency abling an electronic link between the card and the information can be used. As such, it should Procedures 20 the transit provider’s reader equipment. The be useful to attorneys, administrators, human C. Suggestions for Access cards allow for a very fast transfer of informa- relations officers, security personnel, financial to Collected Information 21 tion that transit providers need to collect their officers, and others. VI. Conclusion 23 TRANSPORTATION RESEARCH BOARD OF THE NATIONAL ACADEMIES 3 PRIVACY ISSUES WITH THE USE OF SMART CARDS By Paul Stephen Dempsey Tomlinson Professor of Law, McGill University I. INTRODUCTION characteristics as fingerprints, hand scans, facial scans, and iris and retina scans can be used as biometric iden- tifiers.1 Thus, the image of a thumb or palm print, or an A. The Potential Uses and Abuses of Smart Cards iris, can be stored and used to positively identify an Transit providers can use Smart Cards for different individual. Cameras can scan the facial characteristics purposes. They can be used to process transit passen- of passengers, identifying suspects with facial recogni- gers through the transit system, and to bill them for tion software, and follow them as they walk through their travel. Thus, the financial and accounting issues passenger terminals. surrounding travel can be accommodated efficiently The algorithm used to identify high-risk airline pas- both from the travel customer and provider perspective. sengers is a closely guarded secret, but may include the Smart Cards can allow prepurchase of travel, from travel history of the passenger—where and when the which each trip results in a deduction, or a subsequent ticket was purchased, whether the ticket was for one- billing of the traveler. way or round-trip travel, whether payment was by cash Smart Cards can also be used by transit employees, or credit card, where and with whom the passenger principally for security reasons. Employees need Smart flew, and whether baggage was checked. In addition, Cards for ingress and egress, and many may have readily available information exists about the individ- safety- or security-sensitive functions posing sharply ual: different government interest concerns as compared to passengers. The transit employee can be prescreened • Credit card purchases, for security purposes and denied access to certain se- • Telephone calls placed, cured areas. The goings and comings of the transit em- • Internet sites visited, ployee also can be monitored should there be a need to • Property title transfers, locate where an employee is, or has been. • Credit history, Smart Cards can also serve as a means of collecting • Employment history, data useful for marketing and planning purposes. Thus, • Criminal arrests and convictions, and if the Smart Card includes passenger demographic or • Tax returns. locational data, then the transit provider can determine traffic flows and plan and build infrastructure to ac- To what extent is, or should, this data be correlated commodate demand, or tailor advertising to induce in- with travel data to identify terrorist or other criminal creased ridership. The data may be stored on the com- suspects? Some data may be irrelevant for law or secu- puter chip embedded in the card, or stored in a remote rity enforcement purposes, and therefore of little practi- computer database accessed electronically. cal concern. For example, visits to Internet porn sites Finally, by adding personal information and perhaps may reveal little about terrorist activity, yet visits to biometric data, Smart Cards can be used to enhance bomb assembly instruction sites may be of legitimate security in the transit system. Passengers who pose a concern to law enforcement and security officials. And security threat can be prohibited entry. Passengers who is it legitimate to correlate information concerning a have been involved in a security incident can be more passenger’s nationality, ethnicity, race, religion, or po- easily identified and arrested. litical affiliation? Biometric identification has been used for years in The more data that is correlated, the more likely it is Orlando theme parks to ensure that the person present- that law enforcement agencies will be able to deter ter- ing the Annual Pass is actually the person who pur- rorist activities. The passenger who is identified as pos- chased it, so that it is not handed off from one user to ing a potential security threat can be banned from the another, thereby harming overall sales. A photograph public transit system.2 Such information also can be on a driver’s license is a rudimentary form of biometric identification to ensure that the person holding the li- cense is actually the person to whom it was issued. 1 Greg Star, Comment: Airport Security Technology: Is the Biometrics technology offers opportunities for per- Use of Biometric Identification Technology Valid Under the sonal identification and correlation of identification Fourth Amendment?, 20 TEMP. ENVTL. L. & TECH. J. 251, 253 with historical conduct. Biometrics is the use of the (2002). 2 unique physical or behavioral characteristics of an indi- “Characteristics such as fingerprints, hand geometry, facial vidual to establish his or her identity. Such physical appearance, and retina and iris scans are all considered bio- metric measures. Because each of these characteristics are, at 4 used to identify and arrest criminals at large, reduce Without a separate battery, they usually have to be drug trafficking, and even collar “dead beat dads.” Yet, between 1 and 3 in. from a reader in order to be read, again, the more effective the security screening mecha- though technology may enhance the size of the radius nisms, the higher the price paid in terms of civil liberty. within which a Smart Card can be read. "Hybrid" or Discrimination against people of Arabic descent, of the "dual-function" Smart Cards have both a contact inter- Muslim faithful, or of people with darker skin is a real face and a wireless antenna embedded in the same mi- risk for a nation that aspires to ethnic neutrality on crochip or storage device.4 such issues. RFID systems have two components—a transponder Improved technology allows enhanced data opportu- (the data-carrying device) and a reader (a radio trans- nities.