Metrolinx continues to share Presto users’ data without requiring warrants


Law enforcement officers are increasingly seeking access to personal information stored on transit riders’ Presto fare cards, with requests for the data spiking by 47 per cent in 2018 compared to the year before.

And while Metrolinx, the provincial agency that controls Presto, only acceded to a minority of the requests, in 22 instances related to law enforcement investigations or suspected offences the agency divulged card users’ information without requiring a warrant or court order, a practice that has troubled rights groups since its was first exposed by the Star two years ago.

“Broadly, the concern is that it’s very important that a mass transit system, a public transit system, doesn’t become a system of mass surveillance,” said Brenda McPhail, director of the Canadian Civil Liberties Association’s privacy, technology and surveillance project.

Metrolinx spokesperson Anne Marie Aikins said in a statement the agency “appropriately balances the commitment to protecting the privacy of Presto card users and maintaining the safety and security of the transit system and its passengers.”

“Staff believe that the current process and policy provides the level of oversight and rigour that is required,” she said.

The figures on Presto information requests are contained in Metrolinx’s second annual report on its privacy policy, which will be discussed at the agency’s board meeting Thursday.

The report shows:

While experts agree that warrants shouldn’t be required in exigent circumstances such as when a rider is believed missing, McPhail said in other cases Metrolinx should require a warrant.

“A warrant provides people with the assurance that the validity of the request from a law enforcement body has been judicially reviewed” and that fulfilled requests “have reached a threshold that’s been adjudicated by a judge and not just a transit employee,” said McPhail, whose organization has formally provided feedback to Metrolinx on its privacy policy.

McPhail said that while Metrolinx is taking positive steps such as publishing the annual report and regularly reviewing its policy, there is a “big hole” in its reporting because the agency doesn’t say how many fulfilled requests lead to a successful outcome, such as charges being laid against someone suspected of a crime. She argued publishing that information would help determine whether law enforcement requests for Presto data are generally reasonable.

Aikins said the outcomes of fulfilled requests are out of Metrolinx’s control and consequently it doesn’t track them, but “we do know internally” that sharing Presto data has helped find missing transit users.

Aikins said Metrolinx will share Presto information without a warrant under certain conditions, such as when “there is a reasonable basis to believe that an offence has occurred” on Metrolinx’s property, such as if a rider assaults a GO Transit bus driver.

In those instances, the agency “will limit the amount of information it discloses to what is relevant and necessary relating to the specific offence,” she said.

According to the report, Metrolinx disclosed customers’ Presto travel records 32 times, and shared registered information such as their name and address 20 times. Because information was shared in only 35 instances, the numbers indicate that in some cases both a cardholder’s travel information and name and address were shared.

The report says Metrolinx rejected requests or asked that they be modified for reasons that included the request being too broad.

In most cases, law enforcement asked for information in relation to a suspected offence committed on transit system property, but in cases where the suspected offence took place elsewhere, Metrolinx requested a court order. The agency also requested a warrant when officers asked for financial transaction information.

The requests were made by Metrolinx transit officers and police forces in Durham, Peel, Toronto, York Region, Hamilton, South Simcoe, Waterloo, Ottawa and Montreal.

The report doesn’t break down on which Ontario transit system the Presto cards that were subject of the requests were used, but more than half of trips paid for with the fare card are on the TTC.

Metrolinx committed to publishing an annual report on law enforcement requests for Presto data in December 2017, after the Star revealed the agency had been quietly sharing customer data with police.

On Monday, a spokesperson for Transportation Minister Jeff Yurek referred questions about Metrolinx sharing Presto data to the office Minister of Community Safety and Correctional Services Sylvia Jones.

A spokesperson for Jones said: “Protection of privacy is an important priority for this government. Any decision to share information would be done directly with a police service.”

Ben Spurr is a Toronto-based reporter covering transportation. Reach him by email at or follow him on Twitter: @BenSpurr


Source link

قالب وردپرس