Transport for New South Wales v Waters

Previous findings and preliminary views

1. We noted at [6] that when applying for a Gold Opal card (that is, a card for seniors and pensioners), a customer provides certain information including their name, address and date of birth. That information is recorded in the Customer Support System which contains two databases - the Customer Database and the Entitlement Management Database. Together, these databases contain what we referred to as the "Registration Data".
2. At [1], we defined the information that is the subject of Mr Waters' complaint as Mr Waters' travel history data. We called this information the "Travel Data." At [12] we found that the Travel Data includes the following information: 1.Opal Card number; 2.date/time of transaction; 3.location; 4.mode of transport; 5.type of Opal Card used; 6.journey cost; and 7.transaction sequence number.
3. At [12] we found that, Travel Data is collected when a customer uses a Gold Opal card to tap on or tap off at a smart card reader.
4. We went on to describe the various databases and to find (at [15]), that the Travel Data is recorded in what is known as the Transaction Database which is part of the Central Core System. We concluded that, "it would be possible to identify a customer's identity from his or her Travel Data, by noting the Opal card number associated with the Travel Data and then searching within the databases that contain the Registration Data for that same number." The link between the Travel Data and the Registration Data is the Opal card number which is contained in both the Central Core System and the Customer Support System which contains the Registration data.
5. We set out our preliminary views on various issues that arose on appeal at [52] - [61]. Of most relevance to our current task of determining the merits of Mr Waters' application are the views expressed at [52] - [55]: 52.Under any application concerning s 8(1) of the Privacy Act, it is first necessary to identify the personal information. Here, it is deceptively easy to say that it is the Travel Data of Mr Waters, that is made personal information because of the link through the Opal Card number between the Central Core System and the Customer Support System. However, saying it that way glosses over important issues. What precisely is the personal information and when does the relevant collection occur? 53.A difficulty arises because a case might be put that the collection of the Travel Data per se (i.e., without the link between the Central Core System and the Customer Support System) is reasonably necessary for a permitted purpose of calculating and charging the customer with the correct fare. In particular, it might be accepted that it was reasonably necessary to capture or collect the Opal Card number as part of the Travel Data for this purpose. Further, the respondent accepts that the Registration Data (including the Opal Card number) is not collected in breach of s 8(1) of the Privacy Act. Accordingly, a real issue arises as to what personal information is being collected and when? 54.During oral argument, the respondent framed the ultimate issue as whether it was reasonably necessary for the appellant to collect the Travel Data as personal information. However, this does not necessarily address the real issue because it focuses on how it is collected or the consequences of collection and not why it is collected. 55.We understand that the respondent accepted that the collection of the Travel Data of an Opal Card customer, other than a Gold Card customer, is not a breach of s 8(1). We also understand that the same Travel Data is collected from the Gold Card customer as is collected from any another customer for the same purposes. Those propositions give rise to the question of whether the link to the earlier collected Registration Data changes the nature of the information collected. If not, could the link cause a breach of s 8(1) of the Privacy Act?
6. It was not in dispute that the registration process is mandatory for Gold Opal card holders and voluntary for other types of customers, including those with full-fare cards and student concession cards. We will refer to the data collected when an unregistered card holder taps on or off as the "Raw Travel Data". The Raw Travel Data cannot be linked to the Registration Data which contains the identifying information, because the card is not registered.

Issues

1. It was against this background that we formulated the following issues for determination on the re-hearing: 1. What is the personal information the subject of the live dispute? 2. When is that personal information collected? 3. What is the purpose of its collection? 4. Is that purpose lawful and directly related to a function or activity of the appellant? 5. Is the collection of that personal information reasonably necessary for the identified purpose? 6. (If different to (1)) What is the purpose of the collection of the Travel Data (acknowledging that it is personal information)? 7. Is that purpose a lawful purpose that is directly related to a function or activity of the appellant? 8. Is the collection of the Travel Data reasonably necessary for the purpose identified in answer to the previous question?

What is the personal information the subject of the live dispute and when does the relevant collection occur?

1. It is not in dispute that his Travel Data is personal information within the meaning of s 4 of the Privacy Act. The appellant's Opal Privacy policy lists the information collected with respect to each Opal card (at 4.2.3). That information is: 1. the Opal card number of the global card that is used; 2. the time and date of tap on and tap off of the Opal card; 3. start and end location; 4. route identifiers; 5. journey transfers (if any); 6. the discount (if any); and 7. the fare charged on the Opal card.
2. Mr Waters relied on two inter-related propositions. The first was that only the collection of the information identified in paragraphs (b) - (e) above is in breach of s 8(1)(b) of the Privacy Act. This is the information which is the subject of the live dispute between the parties. On the re-hearing, Mr Waters did not allege that collection of the information in (a), (f) and (g), including the Opal card number, is in breach of that provision.
3. The second proposition is that his Travel Data only becomes "personal information" when it enters the Transaction Database because, at that point, it satisfies the definition in s 4 of the Privacy Act as being "information . . .about an individual whose identity . . .can reasonably be ascertained from the information." According to Mr Waters, it is not clear on the available evidence whether travel history data is personal information when it is recorded by the card reader. We will address the second proposition first.
4. We accept the uncontested evidence from two Transport for NSW employees, Mr Whitbourn and Mr Clark, that it takes varying amounts of time, perhaps a couple of hours, for the Travel Data to be recorded in the Transaction Database.
5. The Privacy Act places limits on the collection of personal information. The information collected must be identified and must come within the definition of personal information in s 4 of that Act before asking whether the information has been collected for a lawful purpose and whether the collection of the information is reasonably necessary for that purpose.
6. The word "collection" is to be "understood as referring to circumstances where the agency is, or has, engaged in the gathering together of information about an individual": PN v Department of Education and Training (GD) [2010] NSWADTAP 59 at [25]. These provisions "are not concerned with internal movements of personal information within agencies": ZR v NSW Department of Education and Training [2009] NSWADTAP 69 at [64].
7. The appellant submitted, on the basis of the evidence, that information is collected by a continuous process which begins when Mr Waters taps on or taps off and ends with the recording and storage of that data in the Transaction Database. There is no separate collection of this data at the point that it is recorded in the Transaction Database. Rather, it is part of the same process of collection that commences at the card reader.
8. We do not consider that personal information may be "collected" from an individual at a point in time which is later than that at which the individual provides the information to the agency, or the agency receives it from the individual. We find that the Travel Data is collected by the card reader when Mr Waters taps on or taps off. What happens to this information within the agency after it is collected cannot be characterised as a second collection. It is the same information and it is only collected once.
9. We also find that the Travel Data is personal information at the time it is collected by a smart card reader. While Mr Waters' identity is not "apparent" when the information is collected by a smart card reader, it can "reasonably be ascertained" by interrogating the Registration Database.

What is the purpose of collection?

1. This question is directed to s 8(1)(a) of the Privacy Act which provides that personal information must be collected for a lawful purpose. As we said at [58] of the first Appeal Panel decision: 58.The concept of "purpose" is central to the operation of the information protection principles including the collection principle in s 8. As the Appeal Panel of the former Administrative Decisions Tribunal said in JD v Department of Health [2005] NSWADTAP 44 at [45], "An overarching consideration in the scheme of this legislation is 'purpose'. 'Purpose limitation' and 'purpose specification' are key privacy protection concepts."
2. The appellant acknowledges in its "Opal Privacy Policy" that, under the Opal Ticketing System, it is collecting information, some of which is personal information. The stated purposes of collection are identified as: (a) managing and operating the Opal Ticketing System; and (b) supporting our responsibilities for coordination, planning and policy development for transport, transport services and transport infrastructure.
3. At 4.2 under the heading, "Our collection of information" the Opal Privacy Policy focuses on registered Opal card holders, which includes Mr Waters: In relation to registered and/or concessional Opal cardholders, we only collect information that is reasonably necessary for the purpose of providing and managing the Opal ticketing system having regard to the Card type.
4. In relation to information collected when the Opal card is used, the Opal Privacy Policy states at 4.2.3, that: We collect information about journeys made with an Opal card in order to account for fares charged, to make payments to transport operators and to manage the Opal Ticketing System.
5. In summary, the appellant submitted that it collects Travel Data in order to calculate and charge each customer with the correct fare, to make payments to transport operators and otherwise to manage the ticketing system. That purpose is said to be the same whether the Travel Data is derived from a Gold Opal card or an unregistered card. The appellant refers to these purposes as "the ticketing purpose". These submissions are consistent with Mr Clark's evidence in his 5 December 2016 statement at [13], that the databases "operate together to ensure that proper payment is made for each journey undertaken on public transport within the Opal network" and we accept them.
6. Mr Waters submitted that the collection of his Travel Data at the card reader for the purpose of making certain information available to the Transaction Database has a different complexion to the collection of his Travel Data for the purpose of calculating the correct fare. There is no evidence of any purpose being to make certain information available to the Transaction Database. That submission is also inconsistent with our finding that there is only one collection of information, not two separate collections.

Is that purpose lawful and directly related to a function or activity of the appellant?

1. This question is directed to s 8(1)(a) of the Privacy Act which requires that personal information is collected for a lawful purpose that is directly related to a function or activity of the agency. There is no dispute that the identified purposes are lawful purposes and that they directly relate to a function of the appellant.

Is the collection of that personal information reasonably necessary for the identified purpose?

1. This question is directed to s 8(1)(b) of the Privacy Act which requires that the collection of the personal information is reasonably necessary for the identified purpose.
2. Because of our previous findings, we have not addressed Mr Waters' submissions which depend on there being a separate collection of information when the Travel Data is recorded on the Transaction Database and proceed on the basis that the personal information is collected at the tap on/tap off point.
3. Mr Waters accepts that the Opal card number and "the time, date, tap on and tap off locations, route identifiers, transfers and mode of transport" (the information described at [14(b)-(e)]) are all required for the card reader to calculate and impose the correct fare. However, according to Mr Waters, the test of whether collection of that personal information is reasonably necessary for the identified purpose should be viewed against whether it is reasonable to expect that the identified purpose could be achieved without interfering with a person's privacy. In other words, if the purpose for collection can be achieved without the information being personal, the collection of personal information is not reasonably necessary. As demonstrated by the case of unregistered cards, where the data collected by the smart reader amounts to Raw Travel Data because the card is not registered, it is possible to achieve the identified purpose (calculation and imposition of the correct fare) without collecting personal information. Mr Waters submits that it is possible to achieve the purpose without collecting personal information; and so, it is not reasonably necessary to collect personal information.
4. Mr Waters submitted that this interpretation is consistent with the objects of Privacy Act including the protection of personal privacy. It was said that this submission does not involve putting a gloss on the meaning of s 8(1)(b). Rather, it comes about because of the factual questions which arise in this case.
5. Collection of the information must be reasonably necessary for the appellant's ticketing purpose. The legal character of that information within s 4(1) of the Privacy Act is relevant only insofar as it means that s 8(1) must be applied at all.
6. We agree with the appellant that the issue is whether the collection of the particular information that constitutes "personal information" is reasonably necessary for the lawful purpose for which it has been collected. Section 8(1)(b) does not require us to answer the question of whether the collection of information as personal information is reasonably necessary. Mr Waters' submission focuses on the consequences of collection, not on whether the collection is reasonably necessary for the ticketing purpose.
7. We find that the collection of the Travel Data is for the ticketing purpose (calculation and collection of the correct fare) and is reasonably necessary for that purpose.

Orders The decision by Transport for NSW on internal review is affirmed.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 18 April 2019