First your phone, now your Presto card: We're sleepwalking into surveillance, privacy advocate says

[caption id=“attachment_70096” align=“aligncenter” width=“720”]

Metrolinx has been giving police access to Presto travel records, sometimes without a warrant. (Metrolinx)[/caption]

The apparent ability of police to access Presto user travel records is just another example of how increasingly difficult it is to avoid having your movements tracked in today’s society, a privacy advocate said Friday.

“We need to quit sleepwalking into surveillance,” said Brenda McPhail, director of the Canadian Civil Liberties Association’s privacy, surveillance and technology project, in an interview.

On June 3 the _ Toronto Star _ revealed that Metrolinx, the provincial crown agency that owns Presto, has on 12 occasions provided police forces with travel records – information on where and when a user tapped their card – sometimes without requiring a warrant.

It is unknown which police forces were given the data but Presto is used across the Greater Toronto and Hamilton Area as well as in Ottawa on OC Transpo.

“Increasingly it’s possible to track people with the technology we use to go about our (daily) lives,” McPhail said. A chief example would be phones that log locations.

McPhail compared the issue to that of personal information held by telecom companies. Police had previously been able to obtain that information without a warrant, until the Supreme Court of Canada ruled that practice unconstitutional in 2014 and said police must get a warrant beforehand.

Like telecom information – which can be used to identify a subscriber – travel records say a lot about who someone is, McPhail said.

Ottawa police could not immediately say whether they had ever used Presto data in the course of an investigation and if so, whether a warrant was involved. “I don’t know if I could say without a doubt,” said spokeswoman Carol MacPherson on Tuesday.

The chief of OC Transpo’s transit police force, Jim Babe, said they have not requested such data.

“At no time have OC Transpo Special Constables sought or obtained access to Presto users’ personal information for general investigative or surveillance purposes,” Babe said in a statement relayed through the city’s media relations office.

Babe said that the City of Ottawa and OC Transpo were aware that Metrolinx has the discretion to provide the data to police without a warrant, but was not aware if it had happened to any OC Transpo customer.

As a public institution, Metrolinx is subject to the Freedom of Information and Protection of Privacy act which allows personal information to be disclosed to “a law enforcement agency in Canada to aid an investigation."

The Presto privacy policy allows for disclosure when “it is required or permitted by law or pursuant to a court order.”

“The reality is, nobody is going to sit down and read the policy,” said the CCLA’s McPhail. “(But) if you read the privacy policy of many companies you’ll see they can do that.”

Metrolinx is taking a second look at its privacy policy, spokeswoman Anne Marie Aikins said in a statement.

“Privacy and the protection of personal information is highly important to us as an organization. We know that it is extremely important to our customers as well,” Aikins wrote. “We want to take this opportunity to examine the feedback to ensure we are striking the best possible balance between upholding high public safety standards, exemplary privacy standards and clear communication with our customers.”

Aikins pointed out that in emergencies or in missing persons cases, a warrant is not always feasible. Out of the 12 occasions Metrolinx provided data to police, six were for criminal matters and six were for missing persons, according to the _ Star _ .

When Metrolinx makes a decision on its current policy, it should be public, McPhail said. As well, they should also inform the public when they have disclosed data and to whom.

“Policies need to be clear and transparent, warrants are ideal,” she summarized.

As well, users can protect themselves by proactively asking questions and writing to their elected representatives – policy gets changed by making a ruckus, she said.

She also suggested customers make it a business issue and boycott companies that do not make privacy a priority.

It may be tough to make privacy a business issue for Presto. It holds a monopoly and the province requires the city to use it in order to get gas tax revenue.