Laura Bobak knows that on Valentine’s Day, she used her Presto card at Glencairn station at 8:11 a.m.
Later that day, at 5:20 p.m., she tapped on at St. Andrew station.
What she didn’t realize is Metrolinx is trailing her footsteps as well.
In a tweet Wednesday afternoon, Bobak posted a screenshot of her Presto transit card activity over the past six days, which detailed the exact date and time – down to the second – of her commute.
“Wow. Amount of personal info @Metrolinx (aka govt) has on your daily routines, whereabouts, hours you keep astounding #ttc #PRESTO #topoli,” she tweeted.
Ann Cavoukian, the executive director of the Privacy and Big Data Institute at Ryerson University, said consent to tie a card user’s identity with their route being tracked by Metrolinx needs to be explicitly noted so customers can opt out if they so choose.
“If I use tokens, that’s anonymous and that’s how I choose to be, but if we’re forced to switch to Presto in a year or so, I sure as heck don’t want my activities tracked,” Cavoukian said. “It’s the location and times and the association with an identifiable individual. And from that, you can make certain insinuations. I’m not suggesting they’re going to do that, but the point is you tread lightly.”
Bobak said on Twitter she recalls having to agree to the terms of use before a tax receipt was issued for her card, but she doesn’t know whether jargon about tracking her movements was mentioned in the contract. She also worries Presto records may be used by police or as evidence in court to perhaps corroborate criminal cases.
“Registering a #PRESTO is like getting a mortgage! Likely did agree b/c wanted receipts for taxes. But reports surprisingly detailed,” she tweeted.
Cavoukian, the former Information and Privacy Commissioner of Ontario, added Metrolinx, a government agency that manages public transit in the Golden Horseshoe region, including Toronto, should indicate what information they will track up front to the customer.
“Privacy is all about control – control over the uses of your personal information, and that’s why you’ve got to seek the user’s consent,” she said. “I’m betting, they don’t lead with a big explanation of what they’re going to do with it and that they might be able to track. I don’t object to the use of the data if it’s anonymized. You can’t use this in identifiable form and assume it’s fine.”
Metrolinx insists it isn’t tracking the daily routines of its customers when they tap their Presto card.
In a tweet, the transit agency said Presto only identifies where a card has been tapped on and off and customers have the option of keeping the card anonymous. If the anonymous choice is selected, Presto doesn’t save any personal information, said the authority. But if they register their cards, information – such as names, address, phone number and email – are sent to a third-party payment processor, Moneris.