Metro Vancouver’s TransLink is routinely providing police personal information of transit users — including where they travelled — without warrants or notification to individuals.
And the amount of information being shared has jumped dramatically in the last two years, according to documents obtained by The Tyee under a freedom of information request.
TransLink documents show it has received 132 requests from law enforcement agencies for information on transit users so far in 2017, and granted 82 requests. If the rate continues for the full year, the number of requests granted will have jumped 30 per cent over 2016.
The information passed on to police could include name, phone number, email address and a history of almost all travel within TransLink’s network if the individual uses a registered Compass card to pay for transit. More than 900,000 people have Compass cards, though not all are registered.
In 2016, TransLink received 147 police requests and handed over information on 111 individuals. In 2015, it received 16 police requests and granted 10.
By comparison, Metrolinx, which has Presto, a similar transit card system in Ontario, had granted just 12 of 26 requests for personal information on riders, according to the Toronto Star. Two requests were supported by court orders. The Ontario card system has 2.5 million users.
The Ontario agency has launched a review of privacy policies in the face of criticism from privacy advocates.
TransLink did not directly respond to an FOI request for its policy on providing information to law enforcement. TransLink only said it follows the applicable section of the Freedom of Information and Protection and Privacy Act, which states that information will be released to assist in a specific investigation “undertaken with a view to a law enforcement proceeding, or from which a law enforcement proceeding is likely to result.”
Chris Bryan of TransLink media relations later confirmed that police officers must fill out a request for disclosure form he provided to The Tyee. The form contains a field “file, ticket or claim number” with the qualifier “if applicable.”
Bryan said TransLink does not verify whether investigations meet the definition of a law enforcement proceeding (or a likely one) within the information and privacy act, and it is up to the law enforcement agency to make that call prior to a request.
Vancouver Police Department media relations were not able to answer questions by publication deadline about internal requirements and controls for officers requesting information about transit riders or what constitutes an investigation “from which proceeding is likely to result.”
Bryan said a significant number of these cases were related to missing persons. In some emergency cases, TransLink shares information without any written request.
TransLink prompts transit users to enter personal information when choosing to register a Compass card. Any users who wish to refill their card online must complete this step.
TransLink confirmed that the information entered then may be provided to law enforcement per the British Columbia Freedom of Information and Protection of Privacy Act (FOIPA).
TransLink also confirmed that it stores limited information on debit and credit card transactions, which could include initial Compass purchases even if people don’t register the card. TransLink stated this kind of record does not contain personally identifying information, but did not say exactly what was retained. When police request this information, said TransLink, they are referred to the applicable financial institution.
Users registering their cards are presented with a form to provide name and contact information. TransLink suggested in the FOI response that users “may” provide the information, but the terms and conditions link states that the rider “must” provide the personal information and it must be “true, accurate and complete.” The terms also require the user to promptly update any contact information that changes, including legal name changes and payment information.
Bryan said the intent was to ensure that transit users are able to receive credit when they lose a card. The policy requiring accurate personal information is not enforced or verified, TransLink confirmed.
When The Tyee began researching this story, the policy’s section on “How your personal information may be shared” contained a sentence in italics stating that TransLink “may share aggregated travel information, if requested, with municipalities and other government agencies.”
TransLink has now added an additional statement: “NOTE: TransLink is legally obligated to share your information with law enforcement when disclosure is required or authorized by law and in accordance with FOIPPA requirements.”
Curiously, the bottom of the document still contained a statement indicating the original creation and modified date of Dec.16, 2014.
“The data collected by Compass cards has enabled TransLink to be far more responsive,” said Bryan. Routes that are overcrowded or underused can very quickly be identified, resulting in better service for all riders.
He added that privacy is a top concern and TransLink is continuing to evolve policy and practices surrounding use and disclosure of data, keeping a close eye on examples from other regions.