I questioned why the biggest utility company in Northern California was scanning our driver's licenses. At first the company defended the practice, but now it has agreed to a big change.
If you walk into any Downtown San Francisco high rise and you might have to sign in, show an ID, or maybe wear a name tag. But what about letting them scan your driver's license? That's what you'll have to do if you want to get into the Pacific Gas and Electric Co. Headquarters in San Francisco.
"We have some extremely sensitive assets in here," said PG&E spokesperson Joe Molica.
I asked Molica to explain what they're doing scanning the information off our licenses.
Finney: All of these high rises around here, when I walk in they may ask me for my name, but nobody else is swiping my ID. What's up with that? Do I look shady?
Molica: We have our employees, our customer information, gas and electric operations for Northern and Central California and we have our child care center. We owe them a strict security system.
PG&E has captured the names and photos off the licenses of thousands and thousands of visitors over the past five years, storing it all in a database along with the date and time of each visit and where each person went each time.
So isn't driver's license information supposed to be private?
"There's a section of the civil code that makes it very clear that a drivers' license can be swiped only in certain, very narrowly defined circumstances and as a condition for entering a building is not one of those circumstances," said ABC7 legal analyst Dean Johnson.
Johnson says California law makes it a crime for businesses to swipe your license and then retain your personal information except for specific purposes, such as bank money transfers, and building security isn't one of the exceptions.
"It's pretty clear that just swiping everyone's driver's license and then using that information to track the comings and goings of the driver license holder is not legal under the statue and anyone who's doing that is almost certainly committing a misdemeanor," said Johnson.
"We do not believe that this was a violation because folks were handing their information voluntarily," said Molica.
However, you cannot get into the building without agreeing to a license scan. PG&E claims the practice is widespread, though we could find no other building in the Bay Area that swipes your license as a condition of entry.
At the Transamerica Pyramid, security doesn't require a license, but it does snap a photo of each visitor to create a badge. And yes, they keep the pictures. At the Federal Reserve Bank, visitors need only have an appointment with someone inside. All of that is within California law.
PG&E would not let us see how their system works, and wouldn't even let us go inside for this interview. So we stood outside.
Finney: You see how this is going to look to some as if you're hiding something, you're keeping me out of the building, you're not letting me see the system.
Molica: Michael, we can certainly let you in the building, but we're just asking to keep a distance.
It was different at the Plug and Play Center in Sunnyvale-- a complex of 300 high tech startups from around the world and a high tech security system for entering.
"We just need to make sure that we know who's accessing the building," said Jeff Carlson from Plug And Play.
Folks there let us see how it works. Visitors provide their name and email address. The system snaps their photo and creates a badge for access. At the end of the day, however, all those pictures are deleted.
"We didn't want the server to have a bunch of pictures on it and frankly, there's no reason to keep it other than to have it on the badge when the person is using the building," said Carlson.
"There's no law that would stop them from taking your photo when you came into the building," said Rainey Reitman from the Electronic Frontier Foundation.
Reitman says the law only restricts capturing your official government ID. She says PG&E's system is more worrisome because a license is your official ID.
"People who want to operate in society occasionally do need to visit buildings and have meetings with other people. PG&E is responsible for your electricity. You shouldn't be forbidden from entering just because you don't want to hand over personal documents," said Reitman.
So what does PG&E react to all this? Two days after we brought this matter to its attention, PG&E changed its security system.
Finney: Really? So our inquiries made you look at the law and look at what's going on?
Molica: We never had a complaint in the over five years we've used this system, until your producer complained about this.
PG&E says it will still require you to scan your license in order to enter the building and it will keep your name in its computer system. However, from now on the company will not retain your diver's license photo in its database without getting your permission first. Already the utility has deleted tens of thousands of photos that were collected in its database over the past five years.
Generally, it's OK to swipe a license to verify age or identity for transactions like buying alcohol. However, it's rarely OK to actually store that information. Johnson says so far no one has sued a business for license swiping, so the courts have yet to clarify exactly when it's legal and when it is not.
