Australian Federal Police investigators have requested travel history and contact details collected from Canberra's MyWay ticketing system more than two dozen times since 2010.
MyWay data held by the ACT government can be disclosed to federal agencies – including the AFP, Australian Tax Office, Centrelink – and as needed in law enforcement, collection of fines or protection of public revenue.
AFP investigators do not need warrants to access MyWay data, and are only required to comply with Australian privacy laws.
An ACT government spokesman said since the introduction of the system to Canberra's bus network in September 2010, the AFP had requested information 27 times, with 16 requests resulting in information being handed over.
No information was received in the remaining 11 instances "because data was not found in the system to match the specifics requested".
The spokesman said the Tax Office and Centrelink had made no requests for information on passengers to date.
More than 304,000 MyWay cards are in active circulation, and records are kept for 373,455 cards. ACT law requires records for the cards must be kept a minimum of seven years.
The spokesman said data from deactivated MyWay cards was also held for at least seven years.
Staff working for the private company that runs the system have their access to data "regularly reviewed". A spokesman said only those involved in MyWay's operations or customer account enquiries can access personal information.
Dr Tim Legrand, a lecturer at the national security college at the Australian National University, said policing agencies were likely to welcome any tool that could strengthen their ability to deter or detect crime.
"The ability to pinpoint the movements of suspects using public transport before, during or after committing an offence is certainly useful, though it should be emphasised that – as a tool – it can only complement and not replace tried-and-tested investigation methods," he said.
But Dr Legrand said there were "some significant privacy concerns" with access to bus data and many people would be unlikely to welcome the prospect of their private data being available to police.
Associate dean at the University of Wollongong’s international school of information systems and technology, Katina Michael, said it was a violation of citizens' privacy rights for public transport cards to be used in a fashion other than what they were intended for.
"Location data can reveal things about a person that should only be accessible with a warrant," she said.
"Who’s to say that this kind of data will not be demanded en masse and used in ways to model a variety of human behaviour using big data approaches?"
Dr Michael said Canberrans should be "very concerned" that police can access bus-users data without a warrant as part of an evidence-based policing movement.
"I am not saying that police should not use this data if they have gone through the appropriate controls, but warrants are essential to ensure that any device that can be used for tracking a person's whereabouts is used justly and ethically," she said.
Australian Privacy Foundation’s chairman Roger Clarke expressed "serious concerns" for the anonymity of bus users and for the due process of law enforcement when told of the AFP MyWay revelations.
Mr Clarke said the foundation had objected to state transport authorities regarding access to personal data, however they had not contacted the ACT government.
Dr Emmeline Taylor, a senior lecturer with the ANU’s school of criminology, said the AFP access to MyWay data without a warrant reflected a “surveillance creep, where data originally used for one purpose is then used for another without the informed consent of subjects”.
“I'd be concerned about whether the public is fully aware of how their data is being captured, stored and potentially later used,” she said.
Thousands of similar requests for personal information and user history have been made in Queensland and Victoria in recent years, including in at least one murder investigation where police tracked a key witness to a Brisbane suburb.
MyWay travel history has been used in the reorganisation of Canberra's bus lines and timetables, including as part of the Network 14 changes announced by Territory and Municipal Services Minister Shane Rattenbury this month.
For transport planning, data is separated from users' personal information.
In NSW, state and federal law enforcement can access travel data and home addresses of commuters using the new Opal smartcard.
Fairfax Media reported Queensland authorities accessed passenger information 10,966 times in the past eight years. In Victoria there has been 274 requests from Victoria Police and the AFP since myki was launched.