How GPS-based Toll Collection Can Revolutionize India's Highways, But at What Privacy Cost?

India's transition towards a GPS-based toll collection system on national highways, as annonced by the Ministry of Road Transport and Highways, could be a major technological disruption aimed at improving efficiency and reducing congestion on toll roads (Link). However, the announcement has invited differening views among various stakeholders due to privacy concerns. This highlights a critical line between technological advancement and individual privacy rights. Some of the important matters that need to be looked while implementing such a project are presented below.

Data Collection: A Limited Scope but Wider Implications

According to the government's announcement, the data collection through the proposed system will only be on national highways, capturing the entry and exit points of vehicles. This method aims to replace traditional toll booths, thereby minimizing traffic bottlenecks and maintaining a seamless flow of traffic. While this seems a focused approach, the privacy implications extend beyond the right of way of national highways.

The system’s capability to track vehicle locations in real time, even if limited to entry and exit, presents a potential risk of misuse of the data. Data aggregation, even if anonymized and used for traffic management, can still be reverse-engineered or repurposed, infringing on individual's privacy unless there are stringent regulations are in place. This is particularly concerning as data protection regulations in India are still evolving.

If this project is implemented, various stakeholders including OEMs, OBU manufacturers, concession companies, banks, and insurers, have commercial interests in how this data is managed. Their involvement requires clear guidelines and restrictions to prevent any potential for data to be used beyond the intended purpose of traffic management.

Moreover, assurances from the government that systems built will have “an inherent redress mechanism” to handle data privacy issues are a step in the right direction. However, specifics on these mechanisms are not yet clear, and without stringent regulations and transparency, public trust in such systems may always be questionable.

Current Data Sharing and Privacy Provisions Under Indian Laws

India’s legal framework on data privacy is still a work in progress phase. The Information Technology Act, 2000, and its rules specifically address electronic data but do not comprehensively cover all aspects of data protection. The proposed Digital Personal Data Protection Act (DPDPA) aims to establish a more robust legal framework. It includes provisions for data minimization, consent, rights of individuals to access and correct their data, and stringent measures for data breaches. However, the DPDPA is yet to be enacted, and until then, there is a lack of specific laws that comprehensively govern the collection, processing, and use of personal data in contexts like the GPS-based toll system.

Global Best Practices for GPS-based Toll Collection

Several countries have already operationalized GPS-based toll collection systems, demonstrating that such technology can be deployed striking a right balance between efficiency and privacy.

1. Germany: LKW-Maut (Toll Collect System) Germany introduced its GPS-based toll system, LKW-Maut, for heavy vehicles on highways in 2005. The system uses GPS and mobile data for automatic toll collection based on the distance traveled. The country has stringent data protection laws in place, including the Federal Data Protection Act (BDSG) and adherence to the General Data Protection Regulation (GDPR), ensuring that vehicle data is securely handled, encrypted, and anonymized when necessary. Data is only retained for toll calculation purposes and deleted after processing.
2. Singapore: Electronic Road Pricing (ERP) Singapore operates an Electronic Road Pricing (ERP) system that uses GPS technology to charge vehicles for road usage based on location and time of day. The system is known for its efficiency in managing traffic congestion. Singapore has strict privacy laws, such as the Personal Data Protection Act (PDPA), to ensure that data collected through the ERP system is handled responsibly, with clear limits on retention and usage.
3. Hungary: HU-GO Hungary introduced the HU-GO system for trucks in 2013, based on a GPS-enabled toll collection mechanism. It allows vehicles to be charged based on kilometers traveled on designated routes. The system ensures that personal and vehicle data are managed in compliance with the country's robust privacy laws and the EU's GDPR regulations, providing transparency about how data is used and ensuring users' control over their information.
4. Sweden: E-Tolling System Sweden’s e-tolling system is another example where GPS-based tolling has been implemented. Vehicles are charged based on the number of kilometers driven on specific routes. The Swedish system operates under strict data protection measures, conforming to the GDPR, and ensures that the data is encrypted and used solely for tolling purposes, with a clearly defined retention period.

Incorporating global best practices can significantly improve the efficiency and privacy concerns of GPS-based toll systems. Some of the things that can be looked into are as follows:

1. Data Encryption: Ensuring all data transmitted and stored is encrypted format can protect against unauthorized access and data breaches.
2. Limited Data Retention: Many countries implement policies that require the deletion of location data after a specific period, minimizing the potential for misuse.
3. Independent Oversight: Establishing an independent body to monitor data collection and usage helps maintain transparency and builds public trust.
4. Clear User Information: Providing clear, accessible information to vehicle owners about what data is collected, how it is used, and their rights regarding data access and correction.
5. Anonymization Techniques: Implementing proven anonymization techniques to ensure that data, once collected, does not reveal identifiable information unless absolutely necessary.
6. Regular Audits: Conducting regular audits and compliance checks to ensure that all parties involved adhere to privacy laws and policies.

Consumer Attitude Towards Data Collection by Service Providers

There is a notable paradox in consumer behavior regarding data privacy. While there are major concerns on government access to location data through systems like GPS based toll collection, many consumers routinely accept similar or even more invasive data collection by private entities such as Google, facebook, whatsapp, instagram and lot more online platforms. This acceptance often arise from the perceived value delivered by these services like navigation, search personalization, and targeted advertising, which enhance user experience.

This discrepancy suggests that while privacy concerns are significant, they can be mitigated if clear benefits are communicated to the users and specially those derived from such services. The government need to clearly communicate the benefits of GPS-based toll system, such as reduced travel times and lower costs, while also implementing strong privacy protections.

Need for a Comprehensive Mobility Data Policy

CITIES FORUM and CEPT Research and Development Foundation as a technical Partner to GIZ India , had undertaken a Project on Smart Mobility Framework in India. As part of this initiative GIZ India had published a Discussion Draft on Mobility Data Policy for India.

The report titled "Mobility Data Policy" proposes a framework for managing and sharing mobility data in Indian context, emphasizing the importance of data standardization, privacy, and accessibility to enhance transport systems. The draft policy paper aims to facilitating cross-sector collaboration between public and private entities to ensure data sharing and interoperability. It stresses the need for structured data formats, regulatory oversight, and governance mechanisms to protect user privacy and ensure data security. Key policy pillars include defining data typology, establishing standards for data collection, promoting open data access, and ensuring citizens' engagement. This policy document also highlights the need for a designated nodal agency to oversee the management of mobility data and calls for the use of public-private partnerships to fund IT infrastructure for data storage and sharing.

The proposed policy further highlights the challenges within India’s existing data policies and the need for a unified governance structure to manage mobility data efficiently, with provisions for data security, privacy, and user consent.

This mobility data policy proposed a framework that can support smart mobility projects such as GPS-based toll collection systems while ensuring required privacy safeguards are in place.

Looking Ahead: The Need for a Comprehensive Data Protection Law

As India plans to implement this ambitious technology driven GPS based toll collection project, the need for a comprehensive and enforceable data protection law becomes more evident. The proposed Digital Personal Data Protection Act must be equipped to address the data sharing and privacy concerns, ensuring that while infrastructure improves, it does not come at the cost of the fundamental right to privacy.

While the GPS-based toll collection system offers operational efficiencies, the Indian government must act fast on its data protection measures to align with global standards. Learning from countries like Germany, Singapore, Hungary, and Sweden, India can implement data encryption, limited data retention, independent oversight, and regular audits as part of its best practices. This would not only safeguard road users privacy but also enhance the credibility and acceptance of such technological transformations in the country.