Metrolinx to consult Ontario privacy watchdog before sharing ridership data

Metrolinx is looking to allay any privacy concerns riders might have about its plans to find new revenue sources, saying it will consult with Ontario's privacy commissioner before sharing "anonymized" GO Transit ridership data with private companies interested in buying the naming rights of GO stations.

The provincial regional transportation agency's chief privacy officer, Heather Platt, will speak to Ontario's Information and Privacy Commissioner Brian Beamish ahead of any sharing of general ridership data to ensure any data exchange follows good business practices, says its senior manager of media and issues, Anne Marie Aikins.

Metrolinx manages a regional transit network in the Greater Toronto and Hamilton area. Beamish contacted the agency to discuss privacy concerns about its recently released plans, Aikins added.

"Whenever there is a public concern, a perception that perhaps there was risk, that's important to us to address that right away," Aikins told CBC Toronto on Thursday. "We happily agreed to work with him and his office to ensure everything that we do is appropriately protecting the public interest and the right to privacy."

Aikins said the agency never had any plans to share personal information about riders.

A document entitled "Metrolinx Station Naming Rights Opportunity," released last week, includes a section on data exchange, saying there is the "potential to share aggregated and anonymized GO Transit ridership data ... for research collaboration and customer mapping research."

For example, she said, if a private company wishes to buy the naming rights of a particular GO station and it was interested in setting up a coffee shop, it would be helpful to know how many people go to the station daily, approximately how many people are there in the morning, afternoon and on weekends, and when peak ridership times occur.

"It can often help make a business decision more attractive," Aikins said.

Aikins defined "aggregated and anonymized ridership data" as basic information about the total number of people at a station at a particular time every day and that is pulled together for research purposes. The data is stripped of personal information, such as name, address, age, contact information and credit card details, that could identify an individual rider.

Presto data will not be included in the ridership data, said Aikins.

"Metrolinx confirms that any data that may be shared with partners for understanding ridership patterns will be aggregated and will not contain any personal information or any other identifiable information that could be tied to an individual," Aikins said in a statement. "At Metrolinx, the security and privacy of data is paramount."

Concerns remain about whether info 'properly stripped'

But privacy concerns remain, said Robert Hudyma, a Ryerson University professor of information technology management.

"The question is: How good is the anonymizing process? How good are the people at protecting your confidentiality? Was the information properly stripped? And was it really and truly anonymized? Would there still be pieces of data that allow you to reverse engineer, and say, you belong to a particular demographic, for instance," he said.

Hudyma said people are concerned about identifying details being released because the exposure of health and financial information, for example, can cause all of damage to lives and reputations.

Data exchange 'all part of marketing package,' prof says

He said Metrolinx may have added "data exchange" to its naming rights document to enhance its marketing. If Metrolinx can provide numbers of people flowing through a given station at a particular time, it could argue that visibility will be high at that station because a certain number of people will see advertising signage, he said.

"It sounds like it's all part of a marketing package to increase the value or maximize the value of those naming rights," he said.

Metrolinx said the naming rights proposal will be posted for 60 days before the agency begins talks with interested parties.

According to the document, Metrolinx is seeking proposals from interested parties for naming rights at five Lakeshore East and Lakeshore West lines: Whitby, Pickering, Exhibition, Clarkson and Oakville. But the agency says it will consider proposals for other stations upon request.