Winnipeg Transit has handed over the private travel history of bus riders to law enforcement without requiring a warrant, CBC News has learned.
City officials confirmed that on four occasions since March of 2017, Winnipeg police have requested the data generated through the use of Peggo cards for a specific passenger to assist with an investigation.
On each occasion, the transit service provided police with the desired records.
Winnipeg Police said the travel data was requested to help with one missing person investigation and three criminal investigations and was therefore releasable under provincial privacy laws.
Police spokesperson Tammy Skrabek confirmed that one arrest occurred as a result of the Peggo card data. She said that law enforcement have many tools at their disposal and accessing data directly from government agencies is generally used as a last resort.
Peggo cards leave digital footprints
In July of 2016, Winnipeg Transit launched its new Peggo card system, which allows users to pay their fare using an electronic card.
It also allows Transit officials to track the exact travel habits of the 130,000 daily Transit passengers.
Every time a passenger uses their Peggo card, data is generated on the date, time, bus number, boarding and transfer locations. If the user has registered their card online, the passenger's name becomes linked to the data.
A spokesperson previously said the transit planning department uses this information to better assess ridership needs and to enhance services, but analysts are not given access to the names of the registered users to protect the privacy of it's ridership.
Hydro flags abnormal energy consumption
Other government bodies also forward personal information to law enforcement without requiring a warrant or court orders, CBC News has confirmed.
Bruce Owen, spokesperson for Manitoba Hydro, said requests from police for account information must be made in writing.
"We provide police information on a customer's account, including confirmation there has been a higher than normal kilowatt-hour consumption," he said.
Data on energy consumption is commonly used by law enforcement — at times controversially — to track down marijuana grow operations within private households.
Manitoba Hydro could not immediately provide figures on the number of times it has released information to law enforcement.
'Quite appropriate to question it', expert.
Tom Keenan, a professor at the University of Calgary who specializes in information security says citizens are generally unaware of the trail of information they leave behind.
"I see a growing sensitivity to this kind of information and it is quite appropriate to question it," says Keenan.
"What we don't want to have is any kind of fishing expeditions [...] the fear is that police will go out there and see everybody who got off at a certain corner and start making inferences from that," he said.
Info release above board: Ombudsman
The privacy and information watchdog for the province says that under the Freedom of Information and Protection of Privacy Act, or FIPPA, any public body can release personal information to law enforcement without the need for a warrant or the consent of the individual being targeted under certain conditions.
Specifically, Section 44(1) of the act outlines conditions under which a public body may disclose personal information to law enforcement:
- If necessary to protect the health and safety of individuals.
- To comply with warrants or other court orders.
- For use in legal proceedings involving police.
- For law enforcement purposes or crime prevention.
"Every authorized use or disclosure of personal information is required to be limited to the minimum amount of information necessary to accomplish the purpose of the disclosure," said Nancy Love, senior legislative and policy analyst for the ombudsman's office.
City officials said they comply with legal requirements and hand over only what is required.
"Every use and disclosure of personal information by or on behalf of the city is limited to the minimum amount of information necessary to accomplish the purpose for which it is used or disclosed," said spokesperson Kailey Barron.
- Metrolinx provided customer Presto data to police 12 times in past year
- Most public organizations not trained to handle privacy breaches
However, the ombudsman's office says this decision making process is ultimately left up to each agency.
"FIPPA does not require a public body to have specific policies about making disclosures. Policies are a best practice," said Love.
She said that in theory, law enforcement can access records about individual citizens from any public body that falls under FIPPA legislation without a warrant. This does not include medical records, which is protected under the Personal Health Information Act or commonly referred to as PHIA.
Winnipeg Mayor Brian Bowman said while he has been assured transit complied with privacy legislation, he wants to know more about what councillors were told about Peggo privacy before the cards went online last year.
"I have inquired with the former chair of [public works], Coun. Janice Lukes, just to see what discussions and due diligence may have occurred by the committee in advance of Peggo being launched, but my understanding is the manner in which Winnipeg Transit has worked with law enforcement has been compliant with privacy legislation," Bowman said.
The following table is an actual sample of data gathered by a Peggo card user. The card number and a few other records have been modified for privacy reasons.