Original URL: http://www.theregister.co.uk/2007/02/22/blair_road_pricing_privacy/

Road pricing - Blair's shock 'privacy guarantee'

Stronger than the usual 'safeguards'?

By John Lettice

Posted in Government, 22nd February 2007 12:52 GMT

The Downing Street road pricing petition, which closed on Tuesday night, has had an immediate but largely unnoticed effect. It appears to have wrung a reasonably firm privacy commitment from Tony Blair.

We should stress at this point that it is only a reasonable commitment, not an absolute one, but although there is wiggle-room, Blair's words (if they're not to be eaten straight away) should place significant restrictions on the kinds of scheme designs that will be possible. Local authorities considering running the government's proposed road pricing pilot schemes would do well to note this now, because they could waste a lot of money on systems that break too many rules to be acceptable.

The key passage comes in Blair's email to the protesters, which went out shortly after the petition closed: "...any technology used would have to give definite guarantees about privacy being protected - as it should be. Existing technologies, such as mobile phones and pay-as-you-drive insurance schemes, may well be able to play a role here, by ensuring that the Government doesn't hold information about where vehicles have been."

The "definite guarantees" of protection of privacy are, as we've already seen in numerous other areas, worthless in that they can be suspended in the name of national security and fighting crime, and are unlikely to apply entirely to whatever long list of accredited officials the Government cares to attach to the enabling legislation. And just last month Blair kicked off a campaign to persuade voters that "over-zealous" data protection rules that impede the sharing of information on citizens should be relaxed. Historically, if the data exists the security services are going to be allowed to trawl it and numerous Government officials will have access to it, and will share it.

So the key commitment from Blair comes with "by ensuring that the Government doesn't hold information about where vehicles have been", and the Government needs to be pressed hard on precisely what he means by that. What is wrong, we could ask, with changing that to "ensuring that nobody holds information about where vehicles have been"? That wouldn't be accepted, but it would help to highlight the intended exceptions.

The current most likely candidate for future road pricing schemes isn't particularly promising when it comes to non-retention of data. In theory various different technologies are likely to be piloted, but the most favoured technology is the European Galileo satellite system, which has been repeatedly referred to in road pricing related speeeches and proposals. Blair himself notes that it will be "ten years or more before any national scheme was technologically, never mind politically, feasible", and is quite clearly talking about Galileo. There is also, from a pan-European perspective, a political necessity that Galileo appear in some way to pay for itself, and road pricing is one of the less hopeless of the ideas hopefully put forward to justify it (the delusional applications they hope will make Galileo a success are worth dealing with in their own right, but another day...).

A system designed around Galileo would work (we use the word advisedly) in a similar way to the lorry road pricing scheme currently used in Germany, and proposed for the UK's Lorry Road User Charging scheme (LRUC), which was abandoned in favour of a general, national scheme in 2005. A 'black box' in the vehicle would be needed to take the vehicle's position from Galileo and to record and/or transmit on this data for use by the charging systems. In such a set-up positioning and use data is clearly collected, and clearly needs to be related to a charging mechanism (which in the case of most motorists would be a named account), and there you have your snoop record, the data that "the Government doesn't hold."

So who does, for how long, and what are the exceptions to deletion? Here, friends, we have arrived in the wiggle space. Short of an unexpected counter-revolution that knocks us back to the 1970s, private contractors will be involved. From a business perspective these will have no need to retain data for long periods, and insofar as there will be cost implications in terms of storage, security and retrieval (for the exceptions), their commercial interest lies in deleting the data fairly speedily once they've got the money. As is the case, ahem, with telecommunications companies and ISPs where, as you may have noticed, Government doesn't hold the data either. It orders the telcos to hold it then helps itself when it feels the need.

It is possible to allow the companies running a road pricing schemes to delete the data quickly, or even, as the consequence of a sudden rush of data protection concern to the head, for Government to require this deletion, but it would be entirely out of character. It would also run counter to planning in Europe, the Department for Transport, police services, and automotive technology.

Europe is keen on black boxes that will be built in by the manufacturers (a directive to this effect is on the wishlist of the DfT's own feasibility study), which means systems that can't easily be interfered with that record driving data, perhaps govern speed, maybe use location data (Galileo) to match position with local limits and adjust speed accordingly, etc. Some of the pay-off from the black boxes will be of benefit to the motorist (e.g. there are advantages to location-based services) but there's clearly a price to be paid in terms of privacy and nanny-avoidance. Consider, for example, the upsides and downsides of Norwich Union's voluntary pay as you drive black box system - you get better rates, but your data is recorded, but only shared with "carefully selected partners". Reportedly, the DfT is considering a similar approach for some road pricing pilots.

While legislators see higher levels of monitoring as being good for road safety, police are keen to benefit from the crime-fighting spin-offs. As we noted last week, ACPO sees Electronic Vehicle Identification (EVI) as a next step in the development of its '24x7 vehicle movement database', and EVI comes as standard with the black box systems. So the point to take on board here is that with or without a road pricing network that has the ability to track you, the police are going to track you anyway, and start using EVI and Galileo to do so, unless the Government orders them to stop. It would however be absurd (or at least it would seem absurd to our legislators) to have a road pricing system collecting all of the data then throwing it away, only to have the police collect it by parallel means, so you can perhaps predict how that one will play out if road pricing gets that far. The privacy threat is clearly broader and further up the food chain than road pricing, or for that matter ID cards, and this needs to be understood if the threat is to be opposed.

Pressing the Government on those road pricing guarantees, however, still has a worth because it is possible to construct non-invasive road pricing schemes, and Blair himself touches on this, albeit in characteristically vague/misleading terms with his reference to "mobile phones and pay-as-you-drive insurance schemes". Anonymous insurance policies? Are you sure about that, Tone?

You meet anonymous pay as you drive systems whenever you use a toll bridge or a road where you hand over some money and a ticket spits out or a barrier lifts. These aren't necessarily or entirely anonymous, because if there isn't already CCTV and an ANPR system at the toll gate there soon will be, and because such systems almost always include a capability to ID vehicles that attempt to subvert them, but in design terms they're pretty much anonymous, and if legislators had the data protection brain rush they'd find it fairly easy to make them more particularly so. Consider the London Congestion Charge in this context - there is much about its design that is anonymous, but its use of registration systems (optional) and recording of ANPR tends to subvert the anonymity. TfL (Transport for London) claims only to retain data on non-payers and to give police access to this, although it's not immediately clear for how long it retains data on compliant vehicles these days.

TfL sees tag and beacon as one of the likely ways forward for the Congestion Charge, and although the DfT's study rejects this as too expensive for a national scheme, it's more obviously viable for urban areas and short stretches, it could be fairly non-invasive, and it's more easily retro-fitted. As an evolution of the Congestion Charge you could envisage this operating as a kind of 'Oyster for autos' - you buy a tag for your car, charge it up with money and as you drive it communicates with beacons on the roads that deduct the cash according to the journey. There needs to be a mechanism for intercepting and billing the 'gate jumpers' superimposed, but in principle the invasiveness of this can be restricted, and if there's one useful lesson the Congestion Charge has taught us it's that a tolerably high level of voluntary compliance can be achieved in such systems.

For the avoidance of doubt, we should point out at this juncture that none of the above should be interpreted as suggesting that we believe the Congestion Charge is either particularly effective or value for money. Oh, no. And it's probably also worth pointing out that a substantial slug of the Congestion Charge 'profit' is still accounted for by penalty charges for non-compliance. The achievement of 100 per cent compliance would at current pricing put it in some considerable financial difficulty.

Galileo however remains the likely winner for as long as a national scheme is on the table, and local planners will quite sensibly take this into account when they're designing their schemes. They won't want to spend on implementing one kind of scheme when they're going to have to start from scratch to implement a different one a few years down the line. So satellite it is? On the other hand, LRUC did not look promising at the time of its demise, and despite the improvements promised via Galileo, satellite projects still have plenty of scope for cock-up, failure, subversion and IT disaster. Nor will Galileo be fully in place until after 2010, so which local authorities will be brave enough to be at the bleeding edge? And how will they fare? But, if you haven't got enough volunteers to pilot the proposed national road pricing technology, what does this mean for the national scheme you're (not?) planning? And how do you pilot a national scheme locally, when the appropriate technologies are quite possibly different?

It's early days, but we think we can smell a train wreck or two not too far ahead... ®