• A court has ruled that NSW must stop “collection of personal information relating to travel movement history”.
• The case was brought by a Gold (seniors) Opal Card user concerned personal information collected could be used to track his movements
• Opal is a contactless smartcard for public transport in Sydney area of New South Wales, introduced in 2012
• Users are encouraged to register online to make it easier to top up the card or cancel it if lost.
• The Australian Privacy Foundation says it’s a major win for privacy rights.

---

Commuters in NSW appear to have just won the right to travel anonymously.

Transport for NSW can no longer use the Opal electronic ticketing system to store personal information and track the movements of specific users.

The NSW Civil and Administrative Tribunal has ruled that collecting and using personal information from Gold Opal cards, which used by seniors, is a breach of the Privacy and Personal Information Protection (PPIP) Act.

It is possible to use an unregistered standard non-concessional Opal card, one linked to a credit card or bank account, and not provide any personal information. However, the personal details of those holding Gold Opal cards are recorded, giving a state government agency, Transport for NSW, the ability to track the movements of individuals as they use the public transport system.

The tribunal said: “The dominant concern is that the introduction of electronic ticketing removed the ability of certain concession entitlement holders to travel anonymously … with their movements tracked by the respondent agency (as an arm of the Government), contrary to the privacy protections of citizens under the PPIP Act.”

In 2015, the NSW Privacy Commissioner said there was a need for commuters to be able to travel anonymously under the Opal system.

Before the Opal system, seniors used their concessions by anonymously purchasing paper tickets from a vendor.

This court case was launched by Nigel Waters, a life member and a former board member of the Australian Privacy Foundation, in 2016.

Waters objected to a record of his travel being kept that was clearly linked to his identity. He wanted to be able to use public transport anonymously in the same way as adult Opal card users could.

“This is major win for privacy rights in NSW,” says Waters.

“It clearly raises the bar for all NSW government agencies to apply ‘Privacy by Design’ principles to complex new data driven systems.”

David Vaile, Chair of the Australian Privacy Foundation, said: “You shouldn’t have to put up with being potentially spied on as you travel just because you verify your eligibility for a concession.”

Waters, who is aged over 60, is entitled to a NSW Seniors Card and a Gold Opal Card. Transport for NSW requires Gold Opal Card users to register their details.

He says he doesn’t object being compelled to demonstrate his eligibility for a gold card or being required periodically to verify that he is still entitled to the card. Part of the eligibility requirements is that users only be working 20 hours or less each week.

“I have no objection to providing personal information, either at the point of acquiring a card or while it is in use, in order to verify my entitlement to a concession card,” he told the tribunal.

Waters at first brought his objections to Transport for NSW.

He complained about the necessity to collect certain personal information at the time that Gold Opal cards are registered. This was an “effective form of surveillance”.

Opal cards have a smart chip which store a dollar value and limited travel history, the last five to seven trips.

However, personal information collected as part of the application for a Gold Opal card is stored in a dedicated database. Travel data collected from Opal readers at train stations and on buses and ferries is stored on a separate database, one managed by a contracted third party, Cubic Transportation Systems Australia.

The Opal Database records each transaction including time, date and location of the tap on or off, the mode of transport, the value of the journey and any discounts applied.

Transport for NSW says this Opal Database does not contain links to the personal information, which is another database.

It told the tribunal the information collected from the Opal readers is not collected in real time and “live tracking” can’t be done.

“Customers who have registered on Opal.com.au may access their own travel history through the website,” it said.

Transport NSW also argued that the registration of the Opal Gold card was necessary in order to deal with frauds.

However, the NSW Privacy Commissioner, in a submission to the tribunal, said: “…the creation of the travel history information has one purpose: to identify the registered card holders. This makes the travel history to be information about the individual, even when interpreting the definition of personal information restrictively, namely capturing the biographical data.”

The tribunal agreed that information provided at the time of application and registration of the Gold Opal card is the applicant’s personal information and subject to privacy laws. It ordered a stop to the “any collection of personal information relating to travel movement history”.

Transport for NSW has been contacted for comment.

It’s not the only legal battle the government authority is facing over the cards.

Last year they were engaged in a cat-and-mouse game with a biohacker who surgically implanted the chip from an Opal card in his hand.

Transport for NSW cancelled the registered card belonging to Meow-Ludo Meow-Meow, saying his actions were in a violation of the card’s terms of use, but because the chip he used came from an unregistered card, they were unable to identify it.

The chip was finally cancelled last month, after the founder of the Sydney tech startup BioFoundry was stopped by ticket inspectors late last year and issued with a $200 fine for not travelling with a valid ticket after he refused to let them scan his hand.

Meow-Meow appears in a Sydney local court tomorrow to contest the fine and has also threatened further legal action over breach of contract, claiming Transport for NSW unlawfully cancelled his registered card in a test case over what he calls “cyborg rights”.

Follow Business Insider Australia on Facebook, Twitter, LinkedIn, and Instagram.