Skip to Content

Myki incident- FAQs for the public

OVIC has published an investigation report about the release of individuals’ public transport data. This blog post contains some frequently asked questions for members of the community who may be concerned about this incident.

Why does government collect data about individuals’ public transport journeys?
Data plays a critical role in transport planning. It helps our public transport networks run smoothly by informing service design.

How many people’s information was in the myki data that was released?
The myki data contained records of 15 million individual myki cards. Because some people have multiple cards, it is impossible to say exactly how many people the information relates to.

While the report indicates information could have been re-identified at the time the dataset was released, the risk to individual myki card holders is now much lower. This is due to the time period the data relates to (July 2015 – July 2018) and the limitations on travel history searches that can be undertaken on registered myki cards.

Why was this information given to a third party?
Public Transport Victoria (PTV), now the Department of Transport, provided the information to a Datathon, an event where data scientists and students compete to find innovative uses for a dataset. The information was given to the Datathon to support innovation and the data science community in Melbourne.

How can I find out if my information was included in the data?
The dataset contained records of almost all myki public transport trips taken between June 2015 and July 2018. If you used a myki card during that time, the dataset most likely contains a record of that usage.

However, the dataset does not contain any names, addresses or immediately identifiable information about people. To link the records of myki trips in the dataset to someone’s identity would take further steps.

How can I find out if I was identified in the data?
Everyone that we’re aware of that has been identified has been contacted directly.

How long was this data available online?
The data was online for the duration of the Datathon between 24 July 2018 and taken offline on 26 September 2018.

What are some of the recommendations from the report?
The report includes recommendations to the Department of Transport and the Victorian government for stronger data release policies and procedures, data governance, training and reporting.

What is government doing to ensure this doesn’t occur again?
The Department of Transport has committed to implementing the Commissioner’s recommendations to ensure this doesn’t happen again. OVIC will continue to monitor the Department of Transport and other public sector agencies in line with the Privacy and Data Protection Act 2014 (Vic) (PDP Act).

Are there any penalties being imposed on the Department of Transport? If so, what are they?
A compliance notice has been issued and the Department of Transport will be monitored for the next 18 months. Failure to adhere to a compliance notice is an offence.

Am I entitled to compensation because of this incident?
No – a person will not be awarded compensation merely because their information was included in the dataset. If a person could prove that they have suffered harm specifically because of this incident, they may be able to make a complaint to the Department of Transport (and ultimately OVIC) under the PDP Act.  This can, in some cases, result in compensation. However, the Commissioner is not aware of any individual cases of such harm having resulted from this incident.

Where can I get more information?
OVIC will update this page if we become aware of further relevant information or to respond to frequently asked questions. For more information about your privacy rights in general, you can contact us on 1300 006 842 or enquiries@ovic.vic.gov.au or see Your Privacy Rights.

One thought on “Myki incident- FAQs for the public

  1. Dr Gregory Hill

    I’m very disappointed to see how this has been handled by the Office of the Victorian Information Commissioner.

    It is not correct in law to state that anyone’s personal identifying information (PII) was disclosed here. The only way an individual’s travel details could be inferred from this dataset is if a separate independent dataset was sourced and used to match against this one. If people wish to disclose their exact travel details on eg Twitter, that is of course up to them. It does not follow that any transactions attached to that are therefore unable to be disclosed in an aggregated and anonymous way, due to the risk that these individuals could be later identified from their own disclosures.

    The “chilling effect” of this misunderstanding will set back the wider goal of encouraging novel and innovative uses of public datasets. As we move further into an information economy, it is imperative that we become more sophisticated in the uses of these kinds of datasets. We also need to encourage the development of skills in this techniques.

    The public interest has not been served here.

Leave a Reply

Comments can be made anonymously, however you may choose to leave your name. We will not use this information for any other purpose than to publish your comment. For more information about the privacy of your personal information and how to access it, please refer to our website privacy statement. Please respect the author of these posts and other contributors when leaving comments.

17 − eight =

Back to top

Subscribe To Our Newsletter

Join our mailing list to receive the latest news and updates from our team.

I'm interested in

You have Successfully Subscribed!