Police Track TransLink Riders Using Debit, Credit Card Info

Even if you don’t register your TransLink Compass card and provide your personal information, your travel history could likely be tracked and shared with police.

A Tyee freedom of information request confirms that police requested the financial transaction data used in Compass card or fare purchases on three occasions in 2017 and obtained it from TransLink in two of those occasions.

The third request did not have any information because the fare or refill (TransLink would not specify) was purchased using cash.

The information retained by TransLink which can be passed to law enforcement includes the type of transaction (credit or debit), transaction date, time, transaction amount and the last four digits of the payment card. The law enforcement agency would then be referred to the appropriate financial institution if it wished to attempt to identify the rider under investigation, TransLink said.

Once a rider’s identity was determined, police could connect it to data obtainable on all travel within the TransLink system using a Compass card.

All three police request were made using a “production order”, which legally obliges TransLink to deliver documents in a specified period. TransLink stated that it was limited by court order from providing any details about these police requests or transactions to The Tyee.

In August, The Tyee broke the news that TransLink was increasingly sharing riders’ personal information — including name, phone number, email address and travel history — with police.

The report revealed that TransLink had received 132 requests from law enforcement agencies for information on transit users in the first seven months of 2017, and granted 82. The number of requests was on track to jump 30 per cent over 2016.

More than 900,000 people have Compass cards, though not all are registered.

By comparison, Metrolinx, which has Presto, a similar transit card system in Ontario, had granted just 12 of 26 requests for personal information on riders, according to the Toronto Star. The Ontario card system has 2.5 million users.

The Tyee report prompted an investigation into TransLink’s “collection, use, and disclosure of its ridership’s personal information” by the province’s Information and Privacy Commissioner.

The announcement of the review did not include a timeline and there have been no updates or progress reports.

When the original story was published TransLink noted that its Compass card registration system is optional and it didn’t enforce a requirement to use real identifying information, despite strong language in the Compass Card Terms and Conditions requiring accurate information and notification of any changes.

However, if police are able to identify a rider using the credit or debit card transaction information, refusing to register the card does not appear to provide any privacy protection.

Information on other transactions, in stores or restaurants or online, could also be provided to police under court order.

Asked about other methods of rider identification sought by police, TransLink wrote that it had no information indicating that video recordings were used to identify ticket purchasers.

However it also said that video footage may be used by law enforcement to identify a person of interest for a specific investigation and that cameras are set up to capture general areas and a Compass vending machine may fall within that view.

The Tyee’s request for all methods used to identify riders resulted in TransLink exercising a right under the Freedom of Information Act to take an additional 30 business days on top of the original 30 days allowed to respond to a freedom of information request.

The final reply was received at 4 p.m. on Nov. 6, exactly 60 business days after the Aug. 9. request.

Other provinces have 30 days rather than the longer 30 business day wait to process FOI requests.