The policy-wonk wet-dream of congestion pricing is the enemy of privacy.
data "will be routinely erased, except for the most recent gas pump receipt"
Data is NEVER, EVER, NO WAY, NO HOW, EVER erased. Understand. Commit this to memory. Remove any doubt. Unbelievable that anyone still tries to claim otherwise. The divorce lawyer will supoena the record to prove infidelity. The police will bust alibis. Search warrants will be issued based on suspicions generated from travel patterns. We can talk about good/bad but forget about any claims of confidential or private.
You can create any Rube Goldberg system you want but I do not believe that in a world of the Patriot Act, data on trip movements — who, where, when, how long etc etc — will remain secret from security authorities.