Warrant use remains sparse in sharing of Presto data
Rising law enforcement requests worrying, civil rights group says
Law enforcement officers are increasingly seeking access to personal information stored on transit riders’ Presto fare cards, with requests for the data spiking by 47 per cent in 2018 compared to the year before.
And while Metrolinx, the provincial agency that controls Presto, only acceded to a minority of the requests, in 22 instances related to law enforcement investigations or suspected offences the agency divulged card users’ information without requiring a warrant or court order, a practice that has troubled rights groups since its was first exposed by the Star two years ago.
“Broadly, the concern is that it’s very important that a mass transit system, a public transit system, doesn’t become a system of mass surveillance,” said Brenda McPhail of the Canadian Civil Liberties Association.
Metrolinx spokesperson Anne Marie Aikins said the agency “appropriately balances the commitment to protecting the privacy of Presto card users and maintaining the safety and security of the transit system and its passengers.”
“Staff believe that the current process and policy provides the level of oversight and rigour that is required,” she said.
More than three million people in Ontario use Presto, which is installed on 11 different transit agencies across the GTA and Ottawa. To use some features of the card, customers must register it by supplying Metrolinx with information including their name, address and credit card number.
The figures on Presto information requests are contained in Metrolinx’s second annual report on its privacy policy, which will be discussed at the agency’s board meeting Thursday. The report shows: Metrolinx received 94 requests last year compared with 64 in 2017. That 47 per cent increase coincided with a 49 per cent bump in the number of transit riders using Presto
Metrolinx divulged at least some information in response to 35 requests, or in 37 per cent of cases
That was down from 2017, when Metrolinx disclosed information in 47 per cent of cases
Of the 94 requests, 50 were related to suspected offences or law enforcement investigations; 43 were related to an emergency, such as a missing person, and one was related to a missing wallet
Metrolinx gave information in 26 requests related to suspected offences or law enforcement investigations; and nine related to an emergency
In just four of the 26 cases related to law enforcement investigations or suspected offences did Metrolinx require a court order to share Presto users’ information. It didn’t require one in the remaining 22
In 2017, Metrolinx gave Presto information in response to 22 requests related to investigations or suspected offences. In two of those cases, it required a warrant before divulging the information and in 20 it did not. However, in 10 of those instances in which it didn't require a warrant, the agency challenged the requests and gave only partial information.
While experts agree that warrants shouldn’t be required in exigent circumstances such as when a rider is believed missing, McPhail said in other cases Metrolinx should require a warrant. McPhail is director of the Canadian Civil Liberties Association’s privacy, technology and surveillance project.
“A warrant provides people with the assurance that the validity of the request from a law enforcement body has been judicially reviewed” and that fulfilled requests “have reached a threshold that’s been adjudicated by a judge and not just a transit employee,” said McPhail, whose organization has formally provided feedback to Metrolinx on its privacy policy.
McPhail said that although Metrolinx is taking positive steps such as publishing the annual report and regularly reviewing its policy, there is a “big hole” in its reporting because the agency doesn’t say how many fulfilled requests lead to a successful outcome, such as charges being laid against someone suspected of a crime.
She argued that publishing that information would help determine whether law enforcement requests for Presto data are generally reasonable.
Aikins said the outcomes of fulfilled requests are out of Metrolinx’s control and consequently it doesn’t track them, but “we do know internally” that sharing Presto data has helped find missing transit users.
Aikins said Metrolinx will share Presto information without a warrant under certain conditions, such as when “there is a reasonable basis to believe that an offence has occurred” on Metrolinx’s property, such as if a rider assaults a GO Transit bus driver.
In those instances, the agency “will limit the amount of information it discloses to what is relevant and necessary relating to the specific offence,” she said.
The report says Metrolinx rejected requests or asked that they be modified for reasons that included the request being too broad.
In most cases, law enforcement asked for information in relation to a suspected offence committed on transit system property, but in cases where the suspected offence took place elsewhere, Metrolinx requested a court order. The agency also requested a warrant when officers asked for financial transaction information.
The requests were made by Metrolinx transit officers and police forces in Durham, Peel, Toronto, York Region, Hamilton, South Simcoe, Waterloo, Ottawa and Montreal.
The report doesn’t break down which Ontario transit system the Presto cards that were subject of the requests were used, but more than half of trips paid for with the fare card are on the TTC.
Metrolinx committed to publishing an annual report on law enforcement requests for Presto data in December 2017, after the Star revealed the agency had been quietly sharing data with police.
On Monday, a spokesperson for Transportation Minister Jeff Yurek referred questions about Metrolinx sharing Presto data to the office Minister of Community Safety and Correctional Services Sylvia Jones.
A spokesperson for Jones said: “Protection of privacy is an important priority for this government. Any decision to share information would be done directly with a police service.”