Metrolinx has been quietly sharing Presto users’ information with police
The transit agency says it does not always require the police to produce a warrant or court order to obtain data about riders’ trips.
By
Ben SpurrTransportation Reporter
Sat., June 3, 2017
Metrolinx has been quietly sharing Presto card users’ private travel records with the police, the Star has learned.
The transit agency has received 26 requests from police forces so far this year and granted 12 of them, according to Metrolinx, which is the provincial transit agency that operates the Presto fare card system used across the GTHA and in Ottawa. It is not known how many requests Metrolinx granted in previous years because the agency only began tracking them in 2016.
The agency says it does not always require law enforcement agencies to produce a warrant or court order to obtain detailed data about transit riders’ trips and doesn’t always notify customers that police have asked for the information.
Experts interviewed by the Star said the practice raises serious concerns about Metrolinx’s policies around the protection of transit users’ personal information.
[...]
Privacy experts said that although Metrolinx’s sharing of data about where and when people ride transit isn’t against the law, the agency isn’t being open enough about how it uses the information it collects from riders.
“It’s certainly a problem,” said Chris Parsons, a research associate at the Munk School of Global affairs who specializes in privacy and security.
While Metrolinx and Presto have both posted privacy policies, Parsons said that because they don’t explicitly state under which circumstances officials will give information to the police, “the public really has no idea what policies, processes or practices Metrolinx has in place or under what conditions it would provide that data.”
Parsons argued that in order to be transparent and accountable to the public, Metrolinx should explicitly and publicly state when it will share their data with police. It should also regularly publish statistics about the number of requests it receives and how they are handled.
Brenda McPhail, director of the privacy, technology and surveillance project at the Canadian Civil Liberties Association, agreed that Metrolinx needs to be more upfront about how it shares customers’ private data.
“Collecting that information gives the company a responsibility to tell people exactly what they’re doing,” she said, noting that data on transit users’ trips can tell police a lot about someone’s personal life.
McPhail also raised concerns that the agency has given out personal information without a court order.
Although there are some exceptions for safety reasons, “we would say that there should be a warrant for collecting that information,” she said.
