Approvals for data on suspects and ‘collateral cardholders’ – people who are not suspects – have more than doubled in 2016

This article is more than 3 years old

This article is more than 3 years old

Law enforcement agencies are dramatically increasing their use of Opal card public transport data to track the movements of people in New South Wales, with approvals for data more than doubling this year.

Internal documents also reveal that police can be handed the information of “collateral cardholders”, or people who are not suspects, when their person of interest’s identity is unknown.

The details of collateral cardholders may be handed over when police request details of all travellers who have used their card at a particular time and place. That may occur, for example, when police have seen a suspect on CCTV, but do not know who they are.



Opal card data has been accessible without a warrant by police and other government authorities since mid-2014, Similar powers are used to access data from Go cards in Queensland, MyWay cards in the Australian Capital Territory and myki cards in Victoria.

New Transport for NSW figures provided to Guardian Australia show law enforcement agencies tried to gain access to Opal data 327 times in 2015, and were successful 96 times.

The number dramatically increased this year. Law enforcement requests had already doubled on 2015 levels by September, with a total of 608 requests, more than a third of which were granted.

Transport for NSW would not say which agencies had requested the data, or how many of those requests came without a warrant. But documents obtained under freedom of information laws show that NSW police were responsible for the majority, while the Australian federal police made occasional requests.



More than half the access requests sought personal information rather than just the travel history of cardholders.

New Opal pricing: NSW public transport users can no longer 'beat system' Read more

An internal document setting out the department’s rules for releasing Opal data to police, seen by Guardian Australia, reveals that information on “collateral cardholders”, people other than the police’s person of interest, can be released in certain circumstances.

The document states that such requests would be inappropriate if they involved the disclosure of “personal information of a significant number of collateral cardholders without good reason (eg, more than seven)”.

Details of collateral cardholders can be released only after the ticketing and concession branch escalates the request to privacy specialists in another area of the department.

The document also states that vague or broad requests should be denied, and that Opal data is not to be handed to police for “general intelligence” purposes.



A Transport for NSW spokeswoman said there was a “rigorous framework” to deal with attempts to gain Opal card data, and it released information only where necessary to find missing people, comply with a subpoena or search warrant, or where it was “reasonably necessary to protect the public”.



“The protection of personal information is properly balanced with the need to ensure community safety and to assist NSW police in the search for missing persons,” she said.

“In any three-month period Transport for NSW rejects around 70% of requests from law enforcement agencies for Opal data, demonstrating the rigorous framework Transport has developed for processing requests.”

But critics have raised concerns about leaving the decision in the hands of the department, rather than a court.

The vice-president of the NSW Council for Civil Liberties, Pauline Wright, said the number of refusals showed that “inappropriate requests are surely being made”.

'Governments do not like freedom of information': the war on Australia's privacy and information watchdog Read more

“Our view still is that requests for this kind of information should only be able to be made by warrant, rather than leaving it up to the discretion of Transport NSW,” she said. “Clearly there’s been a huge increase in two years in the number of requests, so one can only surmise that the circumstances in which those requests are being made are broadening.

“So as police realise how easy it is to get this, there’s a real potential that it’s being requested in completely inappropriate circumstances.”

Registered Opal cards contain first and last names, addresses, details of the preferred contact method, date of birth, and use and travel history. Concession card holders also have information about the identification they used to prove their entitlement.

The data is managed by a third-party contractor, Cubic Transportation Systems, and Transport for NSW has a formal agreement with NSW police about accessing the data. The process is subject to annual audits, the requirements of NSW privacy laws and the scrutiny of the privacy commissioner.

The internal rules warn department employees that: “Vague, non-specific intelligence gathering requests from law enforcement agencies are not considered to be legitimate law enforcement purposes for the disclosure of Opal information.”

It also cautions against providing volumes of data for a large window of time, except in special circumstances.