Compass raises privacy concerns
Advocates worried about access to card users’ data and transit cops’ ability to track ‘taps’
Privacy advocates are urging Metro Vancouver transit riders to carry cash if they want to travel under the radar.
They say the new Compass Card system raises several concerns about the privacy of its more than 550,000 users.
Transit Police have the ability to track a rider’s past 10 “taps” using hand-held units (HHUs) to check if cards are stolen, expired, have a valid tap-in and contain a valid fare.
The HHUs don’t show police a rider’s personal information, such as their name, address or credit card number, TransLink said in an email.
“Cards only store the product and value on the card, its serial number, and the travel and financial transaction history,” TransLink said.
But how that history may be used has privacy advocates concerned.
“The police want that information for a reason,” said Micheal Vonn, policy director at the B.C. Civil Liberties Association.
“It’s not a matter of suggesting that you have something to hide. The question is, how do we contend with the fact that this system tracks you?
“It’s kind of like asking, ‘How do you feel about having the police follow you around on your daily route?’ Because this would amount to essentially the same information outcome.”
Vonn said riders with privacy concerns should consider using cash to buy and load their Compass cards instead of registering them.
“You minimize the amount of tracking that can be traced to you by paying for your card in cash,” Vonn said.
Vonn said there’s a “huge red flag” to send up about systems that don’t let riders to pay with cash.
“However much we shape the system here, there will always be people for whom it will be, at a minimum, a security concern,” she said.
“For those people, cash has to be an option. We’re very concerned about systems that do not allow for that, and don’t want to see those in the future.”
Vincent Gogolek, executive director at the B.C. Freedom of Information and Privacy Association, said it’s clear that TransLink has “put some thought into” the issue of privacy.
But he’s concerned with how the data may be used if TransLink someday changes its privacy policy or if such data falls into the wrong hands.
Gogolek said he questions, for example, whether Compass’s data storage poses a threat to someone fleeing an abusive partner who’s gained access to their tap-in itinerary because they share a Compass account.
Or, he said, if some day, to increase revenue, TransLink sells rider data to businesses looking to target them with marketing based on their transit routes.
“This is not the current Compass card, but places it could go if people decide to take it there,” Gogolek said.
“That’s the thing about big data — this data wasn’t available to anybody because it didn’t exist. Now it’s available and TransLink has it because that’s the way the system works. The question is, what do they do with it?”
TransLink said the Compass Card system adheres to the privacy and security requirements of B.C.’s Freedom of Information and Protection of Privacy Act (FOIPPA).
Information from a registered card can be used for internal promotions, market research and “other future benefits,” according to a TransLink privacy statement.
TransLink must share personal information with law enforcement when disclosure is required or authorized by law and in line with FOIPPA requirements.
But personal information may only be shared with “providers whose services are related to delivery and operation of the Compass program, and who meet our strict privacy and security requirements.”
TransLink said it’s heard from customers who are “uncomfortable” registering their Compass Cards. It recommends they use cash, credit or debit at Compass vending machines to buy and load their cards.
The Office of the Information and Privacy Commissioner for B.C. said in an email that it has “not received any complaints about Compass and privacy issues.”