Researchers have managed to identify the daily movements of a Victorian MP mainly using Myki data that was meant to be anonymous.
Subscribe now for unlimited access.
or signup to continue reading
They also say a child's regular solo trip to school could be spotted with only a few bits of extra information, such as social media posts.
Public Transport Victoria released the de-identified data in 2018 as part of the Data Science Melbourne event, but university academics have shown it is possible to use the information to track someone's daily trips.
Lead researcher Chris Culnane, from the University of Melbourne, said most Myki users in the dataset could be identified from just a few touch-on or touch-off events.
"With just a handful of pieces of information about where someone boards or exits public transport, it's possible to get an indication of where they live or work, their regular travel patterns, who they travel with, or if they travel alone," Dr Culnane said on Thursday.
"For example, children heading home from school alone.
"Our analysis raises serious privacy, safety and security issues. It's easy to imagine how information like this could be used by people who might want to cause harm."
When PTV released the data, the only information it withheld was the person's name if they had registered the card.
Despite this redaction, the researchers' data analysis was able to link all trips on the same card.
The researchers were also able to re-identify a state MP by analysing a handful of their tweets about travelling on public transport.
Victorian Information Commissioner Sven Bluemmel found PTV had breached the Victorian Privacy and Data Protection Act by releasing the data.
"Your public transport history can contain a wealth of information about your private life," he said.
"This is information that I believe Victorians expect to be well-protected."
Mr Bluemmel's report provided seven recommendations to improve data privacy in the Victorian public sector.
The Department of Transport, of which PTV is now a part, said it was not possible to re-identify anyone just based on the data provided nor establish a complete picture of anyone's trips.
It has started implementing three recommendations made in the report as well as a new, enhanced privacy and research ethics framework
"Careful sharing of data makes an important contribution to how we improve transport services for all Victorians - it's vital we continue to update our privacy protections," deputy secretary Jeroen Weimar said in a statement.
Australian Associated Press
