Myki incident- FAQs for the public
OVIC has published an investigation report about the release of individuals’ public transport data. This blog post contains some frequently asked questions for members of the community who may be concerned about this incident.
Why does government collect data about individuals’ public transport journeys?
Data plays a critical role in transport planning. It helps our public transport networks run smoothly by informing service design.
How many people’s information was in the myki data that was released?
The myki data contained records of 15 million individual myki cards. Because some people have multiple cards, it is impossible to say exactly how many people the information relates to.
While the report indicates information could have been re-identified at the time the dataset was released, the risk to individual myki card holders is now much lower. This is due to the time period the data relates to (July 2015 – July 2018) and the limitations on travel history searches that can be undertaken on registered myki cards.
Why was this information given to a third party?
Public Transport Victoria (PTV), now the Department of Transport and Planning, provided the information to a Datathon, an event where data scientists and students compete to find innovative uses for a dataset. The information was given to the Datathon to support innovation and the data science community in Melbourne.
How can I find out if my information was included in the data?
The dataset contained records of almost all myki public transport trips taken between June 2015 and July 2018. If you used a myki card during that time, the dataset most likely contains a record of that usage.
However, the dataset does not contain any names, addresses or immediately identifiable information about people. To link the records of myki trips in the dataset to someone’s identity would take further steps.
How can I find out if I was identified in the data?
Everyone that we’re aware of that has been identified has been contacted directly.
How long was this data available online?
The data was online for the duration of the Datathon between 24 July 2018 and taken offline on 26 September 2018.
What are some of the recommendations from the report?
The report includes recommendations to the Department of Transport and Planning and the Victorian government for stronger data release policies and procedures, data governance, training and reporting.
What is government doing to ensure this doesn’t occur again?
The Department of Transport and Planning has committed to implementing the Commissioner’s recommendations to ensure this doesn’t happen again. OVIC will continue to monitor the Department of Transport and Planning and other public sector agencies in line with the Privacy and Data Protection Act 2014 (Vic) (PDP Act).
Are there any penalties being imposed on the Department of Transport and Planning? If so, what are they?
A compliance notice has been issued and the Department of Transport and Planning will be monitored for the next 18 months. Failure to adhere to a compliance notice is an offence.
Am I entitled to compensation because of this incident?
No – a person will not be awarded compensation merely because their information was included in the dataset. If a person could prove that they have suffered harm specifically because of this incident, they may be able to make a complaint to the Department of Transport and Planning (and ultimately OVIC) under the PDP Act. This can, in some cases, result in compensation. However, the Commissioner is not aware of any individual cases of such harm having resulted from this incident.
Where can I get more information?
OVIC will update this page if we become aware of further relevant information or to respond to frequently asked questions. For more information about your privacy rights in general, you can contact us on 1300 006 842 or enquiries@ovic.vic.gov.au or see Your Privacy Rights.