Information commissioner finds Public Transport Victoria guilty of breaching privacy

The private trips from more than 15 million Myki cards were released to the public in a huge data breach. Here’s how it happened.

Private travel histories for millions of Myki users were unlawfully released to the public for a competition by Victoria’s transport department, according to the state’s data watchdog.

Victoria’s Information Commissioner has found that Public Transport Victoria, now part of the Department of Transport, breached privacy laws by releasing massive amounts of Myki data.

PTV released information from 15 million Myki cards in July 2018 that recorded 1.8 million “tap ons” and “tap offs” for a datathon event.

The information was claimed to have been de-identified.

But months later academics at the University of Melbourne reported that they could use the data to track their own travel histories as well as the journeys of others.

“Although the initiative was well-intentioned, failures in governance and risk management undermined the protection of privacy,” Information Commissioner Sven Bluemmel said.

“Your public transport history can contain a wealth of information about your private life. It reveals your patterns of movement or behaviour, where you go and who you associate with.

“This is information that I believe Victorians expect to be well-protected.”

Myki data was claimed to have been de-identified. Picture: Mark Dadswell

Dr Chris Culnane, from the University of Melbourne’s school of computing and information systems, said most Myki users were identifiable from just a few touch on events.

“With just a handful of pieces of information about where someone boards or exits public transport, it’s possible to get an indication of where they live or work, their regular travel patterns, who they travel with, or if they travel alone — for example, children heading home from school alone,” he said.

“Our analysis raises serious privacy, safety and security issues. It’s easy to imagine how information like this could be used by people who might want to cause harm.

“This isn’t the first time a government agency has released data about the public and claimed it was de-identified.

“Above and beyond the desire to release and share data, privacy needs to be the number one priority.”

MOBILE MYKI USAGE PICKS UP SPEED

$700M MYKI CONTRACT RENEWED BEFORE REVIEW

MYKI GOES MOBILE IN NEW TECH TRIAL

The commissioner’s investigation found PTV did not consider that the data could be used to identify people’s travel history before releasing it to the public.

The Department of Transport has denied that it breached Myki user’s privacy but has agreed to act on a compliance notice to strengthen their policies.

Department of transport deputy secretary Jeroen Weimar said the department took privacy concerns seriously.

“We have accepted the three recommendations made by the Commission and have already started implementing them,” he said.

“Careful sharing of data makes an important contribution to how we improve transport services for all Victorians - it’s vital we continue to update our privacy protections.”

Earlier this year, mobile Myki became available across the state’s public transport network for commuters with Android phones.

Opposition Transport Infrastructure spokesman David Davis said location data could play a vital role in transport if privacy protections remained the first priority.

“Daniel Andrews has form on data and has been proven yet again to have zero respect for Victorian individuals’ privacy,” he said.

“The bottom line is Victorians simply cannot trust Daniel Andrews with their data, even their myki touch-on, irrespective of his Government’s rationalisations for its use.”