One of the key observations in a new report on making our transport infrastructure more efficient is to not repeat information handling mistakes made overseas.

A short time spent on the web reveals the kinds of examples the transport sector in New Zealand would do well to avoid.

There’s the Swedish national transport agency data breach a few years ago in which the personal information of millions of people was leaked to marketers in Eastern Europe. There’s the ransomware hack that crippled the San Francisco rail system. And there are evident vulnerabilities in the public transport system in the American capital Washington.

What does this have to do with privacy? Do cars and buses have privacy now? Obviously not, but their drivers and occupants do. Snapper, Hop or Metro public transport cards – and other services like Uber – collect information about where and when you go places.

For instance, the New Zealand Transport Agency uses commuters’ Bluetooth-enabled devices to calculate how long it takes to travel between destinations so they can inform other commuters of transit times. We have seen concerns arise overseas over the information these services collect. Here’s one very recent example from Australia.

Intelligent mobility

Back in 2016, our office attended a series of industry discussions around the future of transport and ‘intelligent mobility’ in New Zealand. The discussions revealed the perception that industry might be hamstrung by the Privacy Act from sharing relevant data.

We’re used to hearing, ‘You can’t do that because of the Privacy Act!’ In fact, there’s even a snappy insider acronym for it – BOTPA (Because of the Privacy Act). Most of the time, the Privacy Act is being used as an excuse for not doing something – not because it is presenting a legal barrier.

More recently, the Ministry of Transport gathered transport industry professionals from both the public and private sector together to talk about what ‘intelligent mobility’ might look like, and our office was again asked to contribute.

Intelligent mobility is defined as a transport system that uses information to inform planning and infrastructure design. It sounds ideal, doesn’t it? Especially when the transport ‘real time signs’ sometimes have an ability to bend time and have a bus arriving in two minutes for almost half an hour!

But when they work, these technologies help to get people where they are going quickly and efficiently. We support transport agencies working together to ensure that transport systems meet our needs now and into the future.

Our discussions with industry formed part of a Ministry of Transport-commissioned report on ‘intelligent mobility’. The Data opportunities for intelligent mobility report identified:

• there was often little awareness of what data had already been collected by an agency;
• poor information sharing was only one aspect reason why data wasn’t being made available to others;
• industry needed to build and maintain strategic relationships and knowledge of what others were doing to ensure data collection and sharing was efficient and proportionate; and
• trust was important in ensuring that people continued to engage with new technologies - and part of maintaining this trust was ensuring privacy was adequately accounted for.

Anonymous data

In our view, the Privacy Act is flexible enough for agencies to engage and share relevant information to ensure our transport systems are fit for purpose. When sharing or collecting information, agencies have to consider whether they need to identify individuals or whether anonymous data would suffice. The more personal information an agency holds, the more risk there is that it could be stolen, accidentally released or maliciously attacked. These risks need to be balanced against the benefits that the agency and customers gain from using the information.

As the privacy advocate who challenged the New South Wales transport agency was able to show, spuriously collecting information about identifiable individuals is not good enough – especially if it discriminates against a particular segment of the public. But if you need information to better understand how people are using the system, then anonymising the information can probably serve just as well.

Another observation included in the report is an apparent lack of communication about the intelligent mobility initiatives and services were being trialled in different parts of the country. The Privacy Act shouldn’t be a barrier to the sharing of this information in making our urban transport systems better for everyone – and it isn’t! The future lies in the words of Buzz Lightyear of the Toy Story films: “To infinity and beyond!”

Image credit: Monopoly the board game - Andrew Moran (via Digital Journal)

International, technology, data