Law enforcement officers are increasingly seeking access to personal information stored on transit riders’ Presto fare cards, with requests for the data spiking by 47 per cent in 2018 compared to the year before.

And while Metrolinx, the provincial agency that controls Presto, only acceded to a minority of the requests, in 22 instances related to law enforcement investigations or suspected offences the agency divulged card users’ information without requiring a warrant or court order, a practice that has troubled rights groups since its was first exposed by the Star two years ago.

“Broadly, the concern is that it’s very important that a mass transit system, a public transit system, doesn’t become a system of mass surveillance,” said Brenda McPhail, director of the Canadian Civil Liberties Association’s privacy, technology and surveillance project.

Metrolinx spokesperson Anne Marie Aikins said in a statement the agency “appropriately balances the commitment to protecting the privacy of Presto card users and maintaining the safety and security of the transit system and its passengers.”

“Staff believe that the current process and policy provides the level of oversight and rigour that is required,” she said.

More than three million people in Ontario use Presto, which is installed on 11 different transit agencies across the GTA and Ottawa. In order to make use of some features of the card, customers must register it by supplying Metrolinx with information including their name, address and credit card number.

Read more:

Three quarters of Presto users are satisfied with the fare card, poll finds

TTC board approves 10-cent fare increase

TTC plans to hire dozens of fare inspectors to deter people from skipping out on paying

The figures on Presto information requests are contained in Metrolinx’s second annual report on its privacy policy, which will be discussed at the agency’s board meeting Thursday.

The report shows:

Metrolinx received 94 requests last year, compared to 64 in 2017. That 47-per-cent increase coincided with a 49-per-cent bump in the number of transit riders using Presto

Metrolinx divulged at least some information in response to 35 requests, or in 37 per cent of cases

That was down from 2017, when Metrolinx disclosed information in 47 per cent of cases

Of the 94 requests, 50 were related to suspected offences or law enforcement investigations; 43 were related to an emergency, such as a missing person, and one was related to a missing wallet

Metrolinx gave information in 26 requests related to suspected offences or law enforcement investigations; and nine related to an emergency

In just four of the 26 cases related to law enforcement investigations or suspected offences did Metrolinx require a court order to share Presto users’ information. It didn’t require one in the remaining 22

Share your thoughts

While experts agree that warrants shouldn’t be required in exigent circumstances such as when a rider is believed missing, McPhail said in other cases Metrolinx should require a warrant.

Loading... Loading... Loading... Loading... Loading... Loading...

“A warrant provides people with the assurance that the validity of the request from a law enforcement body has been judicially reviewed” and that fulfilled requests “have reached a threshold that’s been adjudicated by a judge and not just a transit employee,” said McPhail, whose organization has formally provided feedback to Metrolinx on its privacy policy.

McPhail said that while Metrolinx is taking positive steps such as publishing the annual report and regularly reviewing its policy, there is a “big hole” in its reporting because the agency doesn’t say how many fulfilled requests lead to a successful outcome, such as charges being laid against someone suspected of a crime. She argued publishing that information would help determine whether law enforcement requests for Presto data are generally reasonable.

Aikins said the outcomes of fulfilled requests are out of Metrolinx’s control and consequently it doesn’t track them, but “we do know internally” that sharing Presto data has helped find missing transit users.

Aikins said Metrolinx will share Presto information without a warrant under certain conditions, such as when “there is a reasonable basis to believe that an offence has occurred” on Metrolinx’s property, such as if a rider assaults a GO Transit bus driver.

In those instances, the agency “will limit the amount of information it discloses to what is relevant and necessary relating to the specific offence,” she said.

According to the report, Metrolinx disclosed customers’ Presto travel records 32 times, and shared registered information such as their name and address 20 times. Because information was shared in only 35 instances, the numbers indicate that in some cases both a cardholder’s travel information and name and address were shared.

The report says Metrolinx rejected requests or asked that they be modified for reasons that included the request being too broad.

In most cases, law enforcement asked for information in relation to a suspected offence committed on transit system property, but in cases where the suspected offence took place elsewhere, Metrolinx requested a court order. The agency also requested a warrant when officers asked for financial transaction information.

The requests were made by Metrolinx transit officers and police forces in Durham, Peel, Toronto, York Region, Hamilton, South Simcoe, Waterloo, Ottawa and Montreal.

The report doesn’t break down on which Ontario transit system the Presto cards that were subject of the requests were used, but more than half of trips paid for with the fare card are on the TTC.

Metrolinx committed to publishing an annual report on law enforcement requests for Presto data in December 2017, after the Star revealed the agency had been quietly sharing customer data with police.

On Monday, a spokesperson for Transportation Minister Jeff Yurek referred questions about Metrolinx sharing Presto data to the office Minister of Community Safety and Correctional Services Sylvia Jones.

A spokesperson for Jones said: “Protection of privacy is an important priority for this government. Any decision to share information would be done directly with a police service.”

Ben Spurr is a Toronto-based reporter covering transportation. Reach him by email at bspurr@thestar.ca or follow him on Twitter: @BenSpurr

Read more about: