From 2030, you will pay for every kilometre driven

This piece in five points:

• In 2030, motor vehicle tax (road tax) will undergo a major change: from then on, motorists in the Netherlands will no longer pay for car ownership, but for every kilometre driven. What is popularly known as road pricing is listed in the coalition agreement as 'pay according to use' (BNG).

• There are two main reasons for introducing BNG: to encourage motorists to use cars more consciously and thus reduce CO2 emissions by a targeted 2.5 megatons, and: to continue to generate sufficient tax revenue through car taxes. Currently, electric cars are exempted from motor vehicle taxes, and with an increasing number of plug-in cars, tax revenues are therefore getting lower.

• The introduction of BNG is very complex. Trade-offs have to be made between issues such as privacy and vulnerability to fraud, between simplicity and available/needed functionality of the implementation method as well as between income differentiation and financial feasibility. Two big questions are: what fee structure will be chosen and how will the government monitor mileage?

• Several ways to check the odometer reading have been suggested: 1. Reading the odometer reading annually from the dashboard; 2. Using a on board unit that tracks mileage based on vehicle data; 3. a combination of GPS tracking and either a on board unit, or an app on the mobile phone.

• It is imperative that the government does not make BNG more difficult than necessary both for itself and for millions of car users. Privacy First has a strong preference for the first option. This is because it keeps data flows clear and limited (data minimisation), and would be the easiest to implement in addition to being the most privacy-friendly.

Road pricing: it has been discussed endlessly over the past decades but never got off the ground. Yet in the Netherlands, paying for the number of kilometres you travel annually in a passenger car and van will become a reality. Only in seven years, though. In 2030, 'pay according to use' be the core element of motor vehicle tax (road tax). Whether by then - as now - the rate will also depend on fuel type, and vehicle weight, as examined in a impact study, is yet to be determined.

There are two main reasons for introducing 'pay by use', or BNG for short:

1. encourage motorists to use cars more consciously, thereby reducing CO2 emissions by 2.5 megatons, and:
2. continue to generate sufficient tax revenue through car taxes.

Currently, electric cars are exempt from motor vehicle tax. So, with an increasing number of plug-in cars, tax revenues (now over €4 billion a year) are getting lower and lower.

There is much to say about BNG and the different ways in which it can be implemented. Trade-offs between issues such as privacy and vulnerability to fraud, between simplicity and available/required functionality of the implementation method as well as between income differentiation and financial feasibility, make BNG very complex. By 'income differentiation' is meant: in the context of egalitarian mileage payments, how do you ensure that someone with a low income and a small car in a rural area with very little public transport pays less than someone with a high income and an SUV living in the big city?

In a report published this week study five possible tariff structures (including a basic structure with one mileage rate for everyone) are compared from different perspectives. Whichever structure the government chooses, there will inevitably be winners and losers are.

Another big unanswered question that is prominent from a privacy perspective is how the government will monitor mileage.
Many motorists will be curious about this. Commissioned by the Ministries of Finance and Infrastructure and Water Management, three options were examined and set out in the background report Mileage registration system for Pay by Use.
The options in a nutshell:

1. Once a year (preferably during the MOT inspection), vehicle owners report the odometer reading on the dashboard or have it checked by an organisation to be determined. The Dienst Wegverkeer (formerly Rijksdienst voor het Wegverkeer), RDW for short, is the most obvious party to take on this task. In terms of feasibility, this seems the most logical option because it fits well with existing operations such as licence plate registration and MOT inspections.

2. The odometer reading is transmitted automatically from a on board unit (OBU): an already built-in or externally fitted 'box' in the car.
Paying by use could potentially lead to less congestion, but as the box does not record location and time, this is not part of the intended objectives.

3. Mileage is derived from GPS tracking and an OBU or an app on the mobile phone that tracks distances.

Several parties, including Privacy First, expressed a preference for the first option at information meetings held by the ministries mentioned (Finance and Infrastructure). That choice keeps data flows orderly and limited (data minimisation), and would be the easiest to implement in addition to being the most privacy-friendly. Also against the background of several large-scale IT debacles within the government, it is important that that government does not make BNG more difficult than necessary, both for itself and for millions of car users. In a position paper (from November 2022), consultancy KPMG warns against underestimating the complexity of implementing BNG.

Comments by option
Below, we give the necessary background information for each option, and make some comments.

1. BNG based on dashboard mileage

Only older cars now have to undergo an annual MOT inspection. New cars will only have to undergo their first inspection after four years, and not every year for the first few years after that. If some motorists have to visit the garage every year just for an inspection of the odometer reading, it will incur extra costs for them.

Currently, there are hardly any MOT requirements for the speedometer and odometer. These must function and be illuminated at night, that's all. If you want BNG to work via meter reading recording, then there must also be MOT requirements for the accuracy of the odometer. And of course, those requirements must then also (be able to) be checked. For this, a test method approved by the RDW will have to be developed and garages will then probably have to buy equipment for this. All this would probably also make the MOT inspection (or single odometer inspection) more expensive for all motorists.

Of particular interest in the background report, Pay by Use, are the concerns about possible mileage fraud. These are understandable: despite the EU obligation as a car manufacturer to ensure that odometer readings cannot be manipulated (Regulation 2017/1151, section 2.3.3) still appears to be possible with most cars. Recently reported the German road assistance agency ADAC said that mileage fraud (especially in commercial vehicles), with or without mileage blockers, is still common. In some cars, via the OBD port and using certain software, you can actually set the tyre diameter yourself. However, the counterattack has been launched and newer models from Audi and Volkswagen, among others, are already much better protected against mileage fraud thanks to the use of Hardware Secure Modules and the increase of the Code Signing certificate from 1024 to 3072 bits. Other car brands will not be left behind in this respect.

To some extent, there is a cat-and-mouse game between technically savvy fraudsters and car manufacturers, but it seems unlikely that this form of manipulation will not have been made very much more difficult, or virtually impossible, by 2030. Possibly through even stricter requirements and better agreements and information sharing between manufacturers and governments. At least for connected cars, which will be in the majority by then. For older cars still on the road, this form of fraud will probably still be possible.

Another way to cheat on mileage is to fit a different size of wheels. This is because the mileage is measured by the axle rotations of the wheels. That number can be made smaller by fitting a car with larger wheels and tyres. It is not illegal in the Netherlands to drive with larger tyres than prescribed by the vehicle manufacturer. However, the lower costs resulting from a smaller number of registered kilometres (a reduction of 5 to 10 per cent seems to be the maximum achievable) will hardly outweigh the cost of larger wheels and tyres, and the expected significantly higher wear and tear associated with them.

A comprehensive follow-up survey on motorists' 'compliance' behaviour only in the scenario based on the odometer reading on the dashboard. The study lists a good number of (hypothetical) reasons why citizens might not (want to) pay for their car use, but there seems to be little among them that will be of great concern to the government. Following a series of recommendations - including ensuring proper education - would also help reduce the perceived risks.

The extent to which mileage fraud will occur in 2030 as a result of the introduction of BNG will depend on the mileage rate yet to be determined. Logic dictates: the higher the tariff, the higher the risk of fraud. Yet Privacy First does not consider the likelihood of large-scale fraud to be very high. The follow-up study itself also reports that the majority of taxpayers are expected to simply comply with the rules.

The tax authorities will surely be able to collect less tax due to some fraud, but they will also bring in a very significant amount of money for kilometres driven abroad that will simply be counted with BNG, penalising everyone driving out of the Netherlands. In this respect, the government could show some leniency towards citizens by not introducing BNG in a strict manner. Not least also because a significant percentage of the people surveyed about BNG on behalf of the ministries are generally distrustful of the government and concerned about privacy and a possible new way for the government to monitor citizens (see Results of qualitative and quantitative research from Motivaction, e.g. pp. 6, 17 and 37).

2. BNG on the basis of a on board unit (OBU) and vehicle data
A variant of BNG where motorists are monitored to some extent is the use of a on board unit (OBU) that will be developed specifically for this purpose, or already built into the car by the manufacturer. Even though a BNG box would not store times and locations, many motorists will be reluctant to install such a device in their car.

As an aside, a majority in the House of Representatives currently wants people who have repeatedly committed gross traffic offences and have been convicted of them to have a get monitoring box in their car that tracks driving behaviour, speed and traffic violations. If the box indicates that an 'axle driver' is at fault again, their driving licence can be revoked. After a trial, the viability of this plan will be reviewed.

There are obviously costs associated with the use of external OBUs. How high will those costs be in the case of BNG and to what extent will it be up to the (less fortunate) motorist to bear them? And then there are the technical snags. The use of 'third-party devices' that connect the car's computer to an outside network increases the car's vulnerability and the likelihood of a cyber attack.

In addition, it is common practice to place only one device in the OBD-II port, which can be used to connect to the vehicle's on-board computer from outside. If the OBD-II port already contains a dongle from - say - a driver's insurance company, you cannot plug in another one from the tax authority that wants to monitor how many kilometres you drive. You can then get to work with a splitter cable, but these do not seem to be reliable by a long shot and it is best to just one device at the same time. Numerous motorists are already driving around with boxes and dongles from different service providers (for more on this, see the previous article in this series: Connected cars as a revenue model for data brokers).

Moreover, there is a chance that dongles and lockers will eventually (that's the reasonably long term, but so is 2030) become less or no longer used and the OBD-II port itself may also disappear (just as the floppy disk and CD-ROM, and the designated slot and drawer in computers have disappeared). For now, an OBD port is still just mandatory, but telematics technology is increasingly being integrated into the car itself.

Should an OBU nevertheless be chosen, the government wants to be sure that the device is switched on and registers the correct distances. In that context, the background report talks about the need for a roadside assistance system that allows communication directly with the OBU or via number plate recognition (ANPR) for control purposes. In short, a control system would have to be rigged or interfaced for the actual control system to work properly. This is as cumbersome as it sounds and almost asking for trouble.

The background report reads as follows:

"To determine whether the OBU is also transmitting the correct value, ANPR should be deployed: does the location of the OBU match the location of the camera where a number plate was recognised? If so, there is no need to keep location data, it can be deleted immediately. There is only a need to record that the OBU transmitted a correct value. If no, this should be kept. After a number of mismatches with the same vehicle, it may be determined that the OBU is malfunctioning, being manipulated or paired with the wrong vehicle. At that point, additional investigation is needed at this vehicle."

Privacy First litigates for years against Automatic Number Plate Recognition (ANPR), which in our view lacks any necessity and proportionality. Under the ANPR law, the license plates and locations of millions of cars in the Netherlands (i.e. everyone's travel movements) are continuously stored for four weeks in a central police database for the purposes of investigation and prosecution, among others - regardless of whether someone is suspected of something. Using ANPR to check whether the odometer reading is being passed on correctly is a form of function creep of a system that Privacy First says is already inherently questionable. (Function creep is the use of personal data, software or hardware for completely different purposes than originally intended).

In the case of connected cars with 'built-in boxes', car manufacturers know exactly how many kilometres a car travels (assuming for a moment that the odometer reading is not manipulated). Handy, you might think, but in that case the question is to what extent it is realistic or practical to expect car brands - based abroad - to continuously report to the Dutch tax authorities how many kilometres their Dutch customers travel. Does the government want to depend on foreign companies for reliable mileage records?

3a. BNG based on GPS tracking and a on board unit (OBU, loose or already built-in)
In any case, with this option that relies on GPS tracking, driven distances are derived from data that most people would probably not want to voluntarily give up to the government: location data. With a location-based solution, privacy is an obvious concern. The background report reports that degrees of privacy protection are conceivable and mentions two possibilities:

1. Location is removed after a certain number of measurements.
For distance determination, a minimum number of locations will have to be kept. With each new location recorded, it is then possible to delete older locations. In this way, it is not possible to retrospectively determine where a motorist has driven. This gives a high level of privacy protection, but at the expense of the possibilities to verify the distance afterwards. Given that differences between a counter reading and measured reading should be explainable by an OBU, this does not seem a realistic solution.

2. Locations are encrypted and only readable by authorised persons.
It is possible to use a smart card-solution store data encrypted and make it readable only with the key. This does allow verification, at the cost of storing more data. This can be done on the OBU itself: the OBU only transmits measured distances and stores locations locally (or also stores them in a secure cloud environment accessible only to the vehicle owner). When changing ownership, this is a concern.

It could all work but it is not without risks and technically it is relatively complex. And without the controversial ANPR (number plate recognition) or a similar system, these scenarios are probably not going to work.

Another technical quirk to take into account: an OBU that relies on GPS may continue to register distances when in reality you are stationary. This is because GPS has an inaccuracy that increases as you move into denser buildings or forestry. Each measurement can deviate slightly. If you stand still at a traffic light or in a traffic jam, for example, and every second the GPS thinks you are moving one or two metres around your spot - first one way and then the other - then on average you stay in your spot, but if all those gauges are recorded, that fictitious distance travelled over a whole year can still add up quite a bit.

It is not very complicated to filter out this anomaly - which also applies to smartphones - software-wise. However, as a motorist, you want to be sure that your OBU has such a filter and that it works properly. Will people soon be able to file an objection if they think their mileage has not been properly recorded, and who will bear the burden of proof?

3b. BNG based on GPS tracking and an app on mobile phone
Using a suitable application, smartphones can accurately and efficiently determine a vehicle's location and distances driven. This also requires no (relatively expensive) additional hardware in a vehicle. While the mileage will be accurate, this scenario still seems the most fraud-prone of all. After all, motorists could also simply turn off their mobile or the dedicated app while driving in order to reduce the odometer reading.

The option to turn off the app should exist anyway, because before you know it, you are paying for kilometres you have not driven. For example, if you cycle, or ride along in someone else's car.

Were BNG to function by means of an app on the mobile phone, driving would require every motorist to have their phone in the car with them at all times (and have the relevant app on). How realistic is that and are you in violation if you don't have that? What if you don't have a mobile phone at all?

Also noteworthy: the background report mentions in this context apps for car systems such as Apple CarPlay and Android Auto that allow direct transmission of vehicle data (to the tax authorities). This bypasses the need to receive data via hubs (or vehicle manufacturers). Vehicle owners could transmit their odometer readings directly to the RDW or the Tax Office via an app. No doubt user-friendly, but as a government, do you want to depend on apps from Silicon Valley tech giants for your tax revenue, or develop your own, mandatory downloadable app for this purpose?

Internet consultation
Should the government eventually still decide to use BNG to address a wider range of problems (e.g. spreading transport over time and location, which is not currently in the coalition agreement), the feasibility will undoubtedly have to be looked at even more closely. Because one comprehensive - but probably very complex - solution for various issues is probably too good to be true. And moreover, one in which data minimisation and the protection of motorists' privacy are difficult to guarantee.

Once the cabinet has taken a decision on how it wants to shape BNG, a consultation on this issue will start. internet consultation enabling stakeholders (once again) to express their views in view of the renewed law.

Postscript: following the fall of the Rutte IV government on 7 July 2023 and the controversial declaration of BNG in the House of Representatives on 12 September 2023, the Ministry of Infrastructure and Water Management halted this project on 1 October 2023. However, it cannot be ruled out that road pricing will be revived at some point in the future. With that possibility in mind, this article remains relevant. Should BNG indeed make a comeback, Privacy First will again keep a close eye on developments in this regard.