Passengers boarding the L2 light rail in Surry Hills have discovered that their phones’ data is being collected via Wi-Fi sensors in a trial that has sparked privacy concerns and divided community opinion.
The trial, run by a private tech company called Flowly in partnership with Transport for NSW, began earlier this year and is set to continue until March 2025. It involves seven trams out of the network’s fleet of 76, including services through the busy suburb of Surry Hills. The sensors collect Media Access Control (MAC) addresses from passengers’ devices to gather data on travel routes, times, and patterns.
How the Data Collection Works
Passengers first learned of the trial from posters displayed inside the trams, which included a QR code directing them to a webpage explaining the process. The webpage stated that Wi-Fi sensors would collect device MAC addresses and anonymise the data after three hours. While the operators assured commuters that their browsing history and personal contacts would not be collected, concerns remain about the implications of collecting MAC addresses.
Transport for NSW stated that the trial aims to address gaps in existing travel data, such as instances where passengers fail to tap on or off using their Opal cards. Flowly’s system is designed to fill these gaps by providing more detailed information about passenger movements, particularly during special events or on shuttle services.
Critics argue, however, that MAC addresses, even when encrypted, could potentially be linked to individuals if combined with other data sources. Privacy advocates, including David Vaile from UNSW, have raised questions about whether such detailed data collection is necessary. He expressed scepticism over the operators’ assurances of anonymity, noting that no system is entirely immune to misuse or breaches.
Community Concerns and Opt-Out Challenges
The trial has raised significant concerns among passengers like Indra Arifin, a Surry Hills resident and web developer, who stopped using the light rail after learning about the data collection. He argued that the system’s opt-out approach puts the onus on passengers, many of whom are unaware of the data being collected until after boarding.
To opt out, passengers must either disable their device’s Wi-Fi before boarding or provide their MAC address through an online form within three hours of the data being collected. Mr Arifin criticised the lack of clear notification at tram stops and said the opt-out model makes passengers feel as though they are being enrolled in the trial without their explicit consent.
“I feel comfortable opting in instead of having to opt out,” Arifin said, echoing the concerns of other commuters who believe the process should be more transparent.
Operators Defend the Trial
A spokesperson for Transdev, the private company operating the light rail, defended the trial, stating that MAC addresses are encrypted and anonymised to ensure passenger privacy. They added that the data is stored securely in New South Wales and complies with privacy regulations. Transdev explained that the opt-out model is necessary to collect enough data to provide a comprehensive understanding of network performance.
Transport for NSW also defended the trial, emphasising its importance in improving public transport services. They highlighted that the trial has been publicised online and through in-tram posters. Despite these measures, critics argue that passengers in busy areas like Surry Hills may not notice the signs, particularly during peak travel times.
Alternatives to the Light Rail
For some commuters, privacy concerns have prompted a shift to other modes of transport. Arifin, for example, now uses the Metro to travel to work, avoiding the light rail entirely. Unlike the light rail, other NSW transport services such as trains and buses rely on Opal card data, which is perceived as less intrusive because it does not involve collecting MAC addresses.
Vaile suggested that less invasive methods could achieve similar results without compromising privacy. While acknowledging the need for data to improve services, he urged operators to explore alternatives that do not rely on tracking passengers’ devices.
Published 2-Dec-2024