Winnipeg Transit gave Peggo card travel history to police without warrants

Winnipeg Transit has handed over the private travel history of bus riders to law enforcement without requiring a warrant, CBC News has learned.

City officials confirmed that on four occasions since March of 2017, Winnipeg police have requested the data generated through the use of Peggo cardsfor a specific passenger to assist with an investigation.

On each occasion, the transit service provided police with the desired records.

Winnipeg Police said the travel data was requested to help with one missing person investigation and three criminal investigations and was therefore releasable under provincial privacy laws.

Police spokespersonTammy Skrabekconfirmed that one arrest occurred as a result of the Peggocard data. She said that law enforcementhave many tools at their disposal and accessing data directly from government agencies is generally used as a last resort.

Peggo cards leave digital footprints

In July of 2016, Winnipeg Transit launched its newPeggo card system, which allows users to pay their fare using an electronic card.

It alsoallows Transitofficials to track theexacttravel habits of the 130,000 daily Transit passengers.

Every time a passenger uses their Peggo card, data is generated on the date, time, bus number,boarding and transfer locations. If the user has registered their card online, the passenger's name becomes linked to the data.

• Check out a sample of the data you generate using your Peggo card

A spokespersonpreviously said the transitplanning department uses this information to better assess ridership needs and to enhance services, butanalysts are not given access to the names of the registered users to protect the privacy of it's ridership.

Hydro flags abnormal energy consumption

Other government bodies also forward personal information to law enforcement without requiring a warrant or court orders, CBC News has confirmed.

Bruce Owen, spokesperson for Manitoba Hydro, saidrequests frompolice for account information must be made in writing.

"We provide police information on a customer's account, including confirmation there has been a higher than normal kilowatt-hour consumption," he said.

Data on energy consumption is commonly used by law enforcement at times controversially to track down marijuana growoperations within private households.

Manitoba Hydro could not immediately provide figures on the number of times it has released information to law enforcement.

• Metrolinx provided customer Presto data to police 12 times in past year

• Most public organizations not trained to handle privacy breaches

'Quite appropriate to question it', expert.

Tom Keenan,a professor at the University of Calgary who specializes in information security says citizens are generally unaware of the trail of information they leave behind.

"I see a growing sensitivity to this kind of information and it is quite appropriate to question it," says Keenan.

"What we don't want to have is any kind of fishing expeditions [...]the fear is that police will go out there and see everybody who got off at a certain corner and start making inferences from that," he said.

Winnipeg Transit gave Peggo card travel history to police without warrants

7 years ago

Duration 2:32

Did you know that every time you hop on the bus and scan you Peggo bus pass to pay your fare, you are providing the city with a detailed travel itinerary of your movements through out the city? CBC News has learned that since March, transit officials have shared the private records of four individuals with the Winnipeg Police without a warrant and without their consent.

Info release above board:Ombudsman

The privacy and information watchdog for the province says that under the Freedom of Information and Protection of Privacy Act, or FIPPA, any public body can release personal information to law enforcement without the need for a warrant or the consent of the individual being targeted under certain conditions.

Specifically, Section 44(1) of the actoutlines conditions under whicha public body may disclose personal information to law enforcement:

• If necessary to protect the health and safety of individuals.
• To comply with warrants or other court orders.
• For use in legal proceedings involving police.
• For law enforcement purposes or crime prevention.

"Every authorized use or disclosure of personal information is required to be limited to the minimum amount of information necessary to accomplish the purpose of the disclosure," said Nancy Love, senior legislative and policy analyst for the ombudsman's office.

City officials said they comply with legal requirements and hand over only what is required.

"Every use and disclosure of personal information by or on behalf of the city is limited to the minimum amount of information necessary to accomplish the purpose for which it is used or disclosed," said spokesperson Kailey Barron.

• Metrolinxprovided customer Presto data to police 12 times in past year
• Most public organizations not trained to handle privacy breaches

However, the ombudsman's office says this decision making process is ultimately left up to each agency.

"FIPPA does not require a public body to have specific policies about making disclosures. Policies are a best practice," said Love.

She said that in theory, law enforcement can access records about individual citizens from any public body that falls under FIPPA legislation without a warrant. This does not include medical records, which is protected under thePersonal Health Information Act or commonly referred to as PHIA.

Winnipeg Mayor Brian Bowman said while he hasbeen assured transit complied with privacy legislation, he wants to know more about what councillors were told about Peggo privacy before the cards went online last year.

"I have inquired with the former chair of [public works],Coun.Janice Lukes, just to see what discussions and due diligence may have occurred by the committee in advance of Peggo being launched, but my understanding is the manner in which Winnipeg Transit has worked with law enforcement has been compliant with privacy legislation," Bowman said.

A sample of your Peggocard footprint

The following table is an actual sample of data gathered by a Peggocard user. The card number and a few other records have been modified for privacy reasons.