By Stephen McKenzie and Eva Lu -
Snapshot
- The NCAT Appeal Panel has affirmed the internal review of Transport for NSW, which found that its collection of travel data from the Gold Opal card did not breach the Privacy and Personal Information Protection Act 1998.
- The decision highlights that NSW public sector agencies that collect personal information must consider why the information is collected, but not whether their purpose could be fulfilled without collecting information of a personal nature.
The NSW Civil and Administrative Tribunal (Appeal Panel) has found that Transport for NSW (‘TfNSW’) did not breach the Privacy and Personal Information Protection Act 1998 (NSW) in its collection of personal information from Gold Opal card holders, thereby overturning NCAT’s first instance decision.
The first instance decision
In February 2018, the NSW Civil and Administrative Appeals Tribunal (‘NCAT’) found TfNSW contravened Information Privacy Principle (‘IPP’) 1 under the Privacy and Personal Information Protection Act 1998 (NSW) (‘PPIP Act’) by its collection of Mr Waters’ travel data via the Gold Opal card system (See ‘Big Brother is watching: the hidden cost of the Gold Opal Card’, 45 Law Society of NSW Journal, June 2018, 74-75).
Section 8(1) of the PPIP Act states that a public sector agency such as TfNSW must not collect personal information unless: (a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and (b) the collection of the information is reasonably necessary for that purpose.
Mr Waters was eligible to apply for a Gold Opal card which entitled him to reduced fares on NSW public transport. Under the Opal system administered by TfNSW, Gold Opal card applicants (seniors and pensioners) receive discounted travel and are required to provide their name, date of birth, address and NSW Seniors Card number as part of the verification and registration process (‘Registration Data’).
TfNSW also collects all Opal card holders’ data including time, date and locations travelled at the time when they are tapped on and off (‘Travel Data’). For full fare paying Opal card holders, the collection of the Registration Data is unnecessary, allowing the card holder to travel anonymously. For Gold Opal card holders, their Opal card number provides an identifiable link between their Registration and Travel Data which are stored on separate TfNSW databases, potentially allowing an individual’s identity and travel history to be revealed.
Mr Waters submitted the Registration and Travel Data were personal information, and their collection was not reasonably necessary for (i) the monitoring of his ongoing entitlement to use a Gold Opal card, or (ii) the calculation and imposition of the correct fare.
