Metrolinx provided law enforcement agencies with Presto fare card users’ personal information 30 times in 2017, complying with roughly half of the requests made by officers.

In a first-of-its-kind report published Thursday, the regional transit agency detailed its response to all of the police applications for Presto information it received last year.

The public disclosure is part of an enhanced privacy policy Metrolinx adopted in December, after the Star revealed it had been quietly sharing Presto data with police.

The fare-card system is employed on the TTC, GO Transit, and nine other agencies in Ontario.

“There were a lot of concerns expressed by the community, specifically from cardholders. They wanted to be confident that we weren’t inappropriately sharing card information with law enforcement,” said Metrolinx spokesperson Anne Marie Aikins.

Share Your Thoughts!

“I think that these new processes and policies will assure people that we’re appropriately balancing the (protection of) privacy, and maintaining the safety and security of their regional transit system.”

According to the report, law enforcement agencies made 64 requests in 2017. Of those, 27 were for emergencies such as a missing person, and 33 were related to investigations into an alleged offence. Four instances were related to found wallets.

Metrolinx provided information for eight of the 27 emergency requests. The agency said that often the missing person was found before it provided police with their card information.

It shared data in the majority of requests related to offence investigations, or 22 out of the 33.

Most of the investigations were related to alleged offences that occurred on a transit system, but two took place elsewhere. In both of those cases, Metrolinx required the police to present a court order to obtain the Presto data. In all the other investigations they didn’t ask for a warrant before providing information.

Most experts agree a court order shouldn’t be necessary if the request is to help locate a missing person, but former Ontario privacy commissioner Ann Cavoukian slammed the agency for not requiring a court order for all requests related to offence investigations.

“The police have a duty to demonstrate that they have probable cause in order to obtain information about individuals,” said Cavoukian, whom Metrolinx consulted about the new policy.

“I’m just so disappointed that they wouldn’t take a stronger position in terms of protecting the privacy of their customers.”

Although Metrolinx agreed to 30 of the requests, in some cases more than one card owner was involved, and the agency says a total of 35 customers’ information was provided.

Aikins said that in the “vast majority” of cases, the information the agency divulged was either the card users’ partial trip history, or contact information such as their name and address.

At least 10 agencies asked Metrolinx for Presto data, including two from outside the province. In addition to requests made by they agency’s own transit safety officers, applications also came from forces in Durham, Edmonton, Halton, Ottawa, Peel, Port Hope, Quebec, Toronto, and York.

Metrolinx didn’t comply with 34 of the 64 requests it received in 2017. The agency said one reason it would reject an application if it was too broad.

In addition to agreeing to publish the annual statistics, as part of its new policy Metrolinx has committed to requiring officers to get their supervisor’s sign-off for all requests, and to the transit agency’s privacy officer or legal counsel review each application before releasing information. It has also publicly posted its policy to provide customers greater clarity about how and when it might give their data to police.

Loading... Loading... Loading... Loading... Loading... Loading...

Metrolinx consulted with the provincial Information and Privacy Commissioner (IPC) on the guidelines, and in January the watchdog recommended some changes, which the agency has agreed to follow.

The IPC suggested Metrolinx report on how often it notifies people when it has shared their data with police, and that it review its privacy policy a year from now.

The agency will also add language to the policy to clarify to customers that in some cases Metrolinx will share data with police of its own accord, if it “has a reasonable basis to believe that an offence has occurred on its property.”

There are roughly 3.5 million Presto cards in use across the province, and roughly 2.3 million have been registered. Personal information is only collected through registered cards.

Read more about: