Loading

By matching a few small details about a person's life with the travel data, a commuter's identity could be found out and their movements tracked by stalkers, abusers or people planning to breach court orders, the Office of the Victorian Information Commissioner has found in a stinging report.

"The dataset contains a wealth of information about the travel movements of Victorians, which was disclosed with no effective controls in place to guard against re-identification," the commissioner's paper released on Thursday found.

"This could allow a malicious third party with access to the data to determine another individual’s history of public transport journeys.

"Members of the Victorian community would expect information about their travel movements to be afforded a high degree of protection."

When PTV was asked by organisers of the conference called Datathon if users could keep the information or had to sign a non-disclosure agreement, PTV responded: ‘No NDA [non-disclosure agreement] to sign this year – you can do what you like with the data."

The information was subsequently published online for the conference from July to September last year and participants were told they were free to use the dataset however they liked.

One Datathon participant re-published the dataset online in full on their blog, where it remained from September 2018 until January this year.

A group of Melbourne University academics who found the dataset online, discovered that they were able to identify themselves, people they knew and even an MP.

The data also includes a description of the type of myki used (there are 70), indicating whether the card owner was part of the police, government, an asylum seeker, veteran or pensioner.

"The dataset contains information about individuals; namely, the location of people at specific times they started or concluded a public transport trip. The dataset also allows more information to be inferred about those people, such as their typical public transport movement patterns," the report stated.

Loading

The dataset could still be stored on the computers of the conference's attendees or by those who accessed it online.

While PTV took some steps to de-identify the dataset before its public release, the commissioner found the process was "inadequate" and accused the agency of relying on "technical arguments" to justify the decision.

In its response to the report, the Department of Premier and Cabinet denied any wrongdoing and rejected the audit's findings that personal information was disclosed.

"The data did not contain any details of any person's identity. Instead, to use the data to re-identify an individual's myki card travel history involves multiple steps, including cross-matching the data with information from other sources and private knowledge."

A Department of Transport spokesman said that a new privacy and research ethics framework was being developed and three of the commisioner's seven recommendations had been adopted.

"Careful sharing of data makes an important contribution to how we improve transport services for all Victorians – it's vital we continue to update our privacy protections."