NSW Transport loses legal battle over Opal tracking

Transport for NSW has lost a legal challenge to its collection of data about the movements of Opal users.

NSW resident Nigel Waters launched the legal battle in 2016 after taking issue with the department's decision to make registration of gold (senior/pensioner) and silver (concession) cards mandatory, meaning the cards are linked to an identifiable person.

Registration is not compulsory for the adult cards that make up the bulk of the public transport network, nor child/ youth cards.

But registered Opal cards also create an "activity statement" of the user's journeys - a record of their travel history over the previous 18 months.

Waters raised issue with the inability of concession Opal card users to avoid having a record of their physical movements across public transport created and linked to their identity.

He alleged Transport for NSW had breached privacy law by collecting more data on travellers than it needed to.

Last month the NSW Civil and Administrative Tribunal agreed and ruled in Waters' favour.

Transport for NSW argues silver and gold cards need to be registered so it can ensure people aren't fraudulently claiming concession fares.

But the tribunal found that the agency's collection of a person's travel history data was not necessary for fraud prevention.

It also knocked back the agency's argument that because TfNSW holds card registration data and travel data in two separate databases - the latter managed by a third party - a person's identity was not easily ascertainable.

“There seems little basis for the collection of the travel information for the stated purpose of enforcement/eligibility for the entitlement to the concession card," it ruled.

The tribunal found the agency in breach of privacy law and ordered it to stop collecting the man's travel data.

It said the same ruling would apply to any other individual who raised the same concerns.

The tribunal told Transport for NSW to take action to make the system compliant with privacy law.

Privacy expert Anna Johnston of Salinger Privacy said the implications of the case would be "profound".

"Much of the value of big data is built on our digital breadcrumbs – the digital traces we leave behind as we go about our day-to-day activities like travelling to work, buying goods, using social media or searching the web," Johnston said.

"But if an organisation does not have a sound reason for collecting those breadcrumbs – in other words, if collecting our data is not reasonably necessary for the primary purpose for which we were transacting in the first place (getting on a bus, buying a pair of shoes, chatting to our friends on Facebook) – then it might not be able to lawfully collect it at all."