The Toronto area’s regional transit agency has admitted that it is occasionally sharing location data from re-loadable payment cards with police.
Metrolinx said it has received 26 requests so far in 2017 from police forces for “tap history” from Presto cards and that it has granted 12 of the requests.
Half of the requests were related to missing persons and the other half were related to alleged crimes, including assault, sexual assault and indecent exposure, according to the agency.
Presto cards are re-loadable cards that users “tap” in order to gain entry to streetcars, buses and trains. Users are encouraged to register the cards online in order to access detailed histories of their travel and so that they can transfer funds from one card to another card, in the event a card gets lost. Users can opt to buy cards with cash and are not required to register.
Brenda McPhail, an expert on privacy issues with the Canadian Civil Liberties Association, said that it is both legal and responsible to share data with police in emergency situations, but that the transit agency should be clearer with its customers.
“If it’s a missing child in particular, no one would say you can’t have that information right away when you need it,” McPhail said. “All we would say,” she added, “is that they should tell people in the privacy policy, ‘if police ask us for information about a missing person we’re going to give it to them without a warrant (and) if police ask us for information in a criminal investigation, barring any emergency situations, we’re going to ask for a warrant.’”
Metrolinx spokesperson Anne Marie Aikins said privacy laws are being followed and that the agency only releases “tap history” for a 24-hour period. She said they never give police any other personal information, such as addresses, linked to the cards.
“So you tapped at College Street and then you tapped at Union Station that specific day,” she said. “That’s it. That’s all we could give.”
Aikins said Metrolinx’s chief privacy officer, a lawyer, is the only person who can give police that information.
She added that the agency will look into whether it can better communicate its privacy policy to the public.
Other transit agencies, including Transport for London in the United Kingdom, publicize that they share re-loadable card information with law enforcement agencies under certain circumstances.
Vancouver’s transit agency TransLink, meanwhile, states in its privacy statement for Compass Cards that it “is legally obligated to share your information with law enforcement when disclosure is required or authorized by law and in accordance with (Freedom of Information and Protection of Privacy Act) requirements.”
With files from CTV Toronto’s Tracy Tong
