The public transport authority in the Australian State of New South Wales has been told to limit the amount of data it collects with its stored value "Opal card", after a decision released by the state's Civil and Administrative Tribunal in February 2018.
The case was brought by Nigel Waters, who complained that Transport for New South Wales (TfNSW) makes it compulsory for holders of the Gold and Silver cards issued to seniors and concession-holders to register in order to obtain their cards. Users of ordinary Opal cards can do so anonymously.
As all trips paid for with Opal cards are recorded, Waters complained that only Gold and Silver card holders' activities could be tied to an individual.
Noting that before Opal was introduced, anybody could travel anonymously, Waters complained that “the ‘requirement’ of collection of his personal information is not reasonably necessary for the unstated purpose of travel on public transport as an eligible Senior.”
The Tribunal liked his line of argument and decided that TfNSW has breached the State's Privacy and Personal Information Protection Act and said that requiring registrants to provide personal information went beyond what's “reasonably necessary” to provide public transport.
Australian privacy commissioner flags new data mining rules for government agenciesREAD MORE
In an internal review related in the decision, TfNSW gave itself the all-clear, claiming there was no breach of the state's Privacy and Personal Information Protection Act.
That review was set aside by the Tribunal, as was a claim by TfNSW that the history related to the Opal card rather than the card-holder. TfNSW has been ordered not to link Opal concession card user identities to a history of their travel.
As noted by privacy experts Salinger Privacy, the tribunal decision only technically relates to Waters' complaint, rather than being broadly applicable.
However, since any other Gold Opal holder could bring the same complaint to the tribunal, Transport for NSW might as well fix the whole system.
Salinger's Anna Johnston also wrote that the decision is important to other data collections because the tribunal didn't have to rule on whether or not Transport for NSW does “routinely” link travel history to names, only that it can do so.
The decision also said that consent can't be forced. “Take it or leave it” provisions that are “something more akin to a lack of choice” don't count as consent. ®
* The Tribunal's decision was published without anonymisation on March 12th, hence our choice to publish today.
Sponsored: Ransomware has gone nuclear