The privacy aspect of E-tickets.

[Haywain]

I thought we were talking about eTickets though.

Great minds!

 

[Wallsendmag]

Great minds!

Indeed

 

[HamworthyGoods]

Southeastern, LNER, Northern and Network Rail are subject to FOI. I can't FOI any other TOC or any third part retailer.

Presumably Translink would also be subjected to FOI as the UK’s only fourth nationalised train operator?

 

[Haywain]

Presumably Translink would also be subjected to FOI as the UK’s only fourth nationalised train operator?

Even if they are subject to FOI they are not going to be able to tell you much about eTickets in the national rail network, which is the subject of this thread.

 

[Bikeman78]

the stations are probably riddled with CCTV, as are many trains, and many ticket barriers will keep the ticket at the end of the journey. Lots of people buy those paper tickets with a card. You are probably carrying a mobile phone (doesn't have to be a smartphone) that has to check in with the network at regular intervals. perhaps not as anonymous as you think.

Google knows exactly where I've been. They send me a monthly report. It knows if I've walked, cycled, driven, taken the train. The one thing that utterly confuses it is extended trips on an underground railway. Clearly all the algorithms are based on "normal" behaviour as opposed to milling about aimlessly and possibly coming back out at the same station I went in.

 

[ashkeba]

that's my point, it's already impractical. you don't have confidentiality when travelling on *public* transport. e-tickets certainly give the authorities a little bit more data (and it has been used, albeit quite sensibly, to knobble people putting in DR claims for trains they had no intention of travelling on)

I remember greater Anglia doing a sweep based on smartcard taps. Who did an eticket sweep?

 

[Haywain]

I remember greater Anglia doing a sweep based on smartcard taps. Who did an eticket sweep?

Nonsense. The source data was Delay Repay claims with the information initially provided by the claimants.

 

[Jurg]

Yes, that's my point. I do hope Google send me relevant adverts and offers. Who wants poorly targeted adverts?

My preference would be for no adverts at all, but in reality there's only so much effort I make to avoid advertising. I mainly just avoid the most obtrusive forms of advertising, like the websites where you can't click a link without something popping up.

The adverts I do come across I try to 'zone out'. I'm a bit bloody-minded in that way, similarly I don't buy anything from cold callers. It's much easier for me to ignore adverts that are irrelevant to me.

So yes, me, I want poorly targeted adverts. But I use e-tickets without compunction or regret.

 

[AM9]

My preference would be for no adverts at all, but in reality there's only so much effort I make to avoid advertising. I mainly just avoid the most obtrusive forms of advertising, like the websites where you can't click a link without something popping up.

The adverts I do come across I try to 'zone out'. I'm a bit bloody-minded in that way, similarly I don't buy anything from cold callers. It's much easier for me to ignore adverts that are irrelevant to me.

So yes, me, I want poorly targeted adverts. But I use e-tickets without compunction or regret.

That's exactly the way that I deal with advertisement. The more banal they are, the easier it is to ignore them. The thread here on annoying adverts reveals just how susceptible many are to adverts. The more that they annoy, the more effective they are. Advertising budgets can run to billions in a large multinational operation, and they aren't commissioned by fools. There is sound psychology behind all high cost publicity and triggering petulent 'I'll never buy from a company that has adverts that irritate me' responses are part of the overall strategy of name and product awareness.

 

[ashkeba]

Nonsense. The source data was Delay Repay claims with the information initially provided by the claimants.

Does this mean no one has done an e ticket sweep?

 

[Haywain]

Does this mean no one has done an e ticket sweep?

I wouldn't know, but scan data on its own is not associated with customers. And customers can buy eTickets for other people, so scan data still doesn't prove much.

 

[Bertie the bus]

the stations are probably riddled with CCTV, as are many trains, and many ticket barriers will keep the ticket at the end of the journey. Lots of people buy those paper tickets with a card. You are probably carrying a mobile phone (doesn't have to be a smartphone) that has to check in with the network at regular intervals. perhaps not as anonymous as you think.

CCTV isn’t a tracking mechanism. Unless it is facial recognition CCTV and you happen to be on the database of people of concern then all you can determine from CCTV is someone is there, not who. Obviously it is possible to track an individual’s movements using CCTV but that takes countless man hours of work and is clearly not something that can be done en-masse.

 

[MikeWM]

CCTV isn’t a tracking mechanism. Unless it is facial recognition CCTV and you happen to be on the database of people of concern then all you can determine from CCTV is someone is there, not who. Obviously it is possible to track an individual’s movements using CCTV but that takes countless man hours of work and is clearly not something that can be done en-masse.

Exactly so. Whatever my qualms about current surveillance systems and databases, things such as CCTV - at least until facial recognition CCTV is widely rolled out - are only of use if you're a 'person of interest', and - assuming there are sufficient safeguards in place for ascribing 'person of interest' status to someone - that's probably not something to complain about too much. You can't data-mine raw CCTV.

The distinction here is between systems that allow putting together identification of a person and their movements, purchases and meetings *once you have ascertained they are of interest in some way*, with having all that data to hand to start with and data-mining it *to determine based on an algorithm if they are of interest in some way*. The latter is *considerably* more dangerous and scary. The former is by definition very limited as it requires a lot of work.

I don't have a lot of time for these 'well, it's already bad so why bother about it getting worse' arguments. Yes, we should have objected more when the first three walls of what could be viewed as a digital prison were erected around us, but that's no reason to meekly accept the fourth wall too. And once the alternatives are removed entirely, rather than just made increasingly difficult, then there are all manner of further unpleasant things that can happen (eg. requiring *permission* to purchase, based on arbitrary criteria set by a central authority), and there will no longer be an alternative option to fall back on if you do decide it is all getting a bit much.

There are many cases when being able to make a journey untracked is preferable or even required - and they don't all involve undesireable criminal conduct. Sometimes privacy really does matter.

 

[trainstrainstr]

mods note - split from here.

Has nobody mention the privacy aspect yet?

With an eTickets, private companies know exactly your full travel history who you are, your home address, exactly what time you travel, etc etc.

Paper tickets can be anonymous.

Paper Tickets are not anonymous, if you pay by card there is a lot of information that COULD be gleaned.

And if I'm completely frank, we don't care that much about what you get up to with regards to etickets or and the like. We take aggregated depersonalised data to build up pictures of our travellers and use that to better inform our marketing. But categorically we don't sit there analysing that John Doe travels to London every week on a Wednesday. We might use the data in customer profiles, but again - we're not spying on you and we don't have any interest in doing so.

 

[AM9]

Paper Tickets are not anonymous, if you pay by card there is a lot of information that COULD be gleaned.

It would be more accurate to say: "Paper Tickets are anonymous unless they are purchased with a payment that is traceable", i.e. Cheque, plastic card or electronic wallet are all traceable, - whereas cash isn't.

 

[Hadders]

And if I'm completely frank, we don't care that much about what you get up to with regards to etickets or and the like. We take aggregated depersonalised data to build up pictures of our travellers and use that to better inform our marketing. But categorically we don't sit there analysing that John Doe travels to London every week on a Wednesday. We might use the data in customer profiles, but again - we're not spying on you and we don't have any interest in doing so.

You might not use the data in that way, but it doesn't mean that someone, somewhere either is doing so or might do so at some point in the future.

As I said upthread I do think there should be transparency about what data is stored, who has access to it, what it is used for, how long it is kept for etc. At the moment there appears to be nothing in the public domain about this at all.

Some large organisations don't have a great track record when it comes to looking after data. I'd like to think the railway would look after this sort of data properly but how can we be sure...

 

[TUC]

I hate to tell people this, but in most cases the information that data gives about their lives doesn't indicate anything particularly interesting.

It's like how a junior doctor friend said to them that every week she sees patients who are really embarrassed about a particular condition and are convinced that they are the only ones with it. The reality is that she has seen three other people with it that week.

 

[sor]

CCTV isn’t a tracking mechanism. Unless it is facial recognition CCTV and you happen to be on the database of people of concern then all you can determine from CCTV is someone is there, not who. Obviously it is possible to track an individual’s movements using CCTV but that takes countless man hours of work and is clearly not something that can be done en-masse.

sure you can, especially when combined with other data sources. Roll the video back to the time of purchase of the glorious, 'anonymous' paper ticket from a machine, or when the train arrived, or when it was put through the barrier (and retained, with your fingerprints on it - at least e-tickets don't have that!). Or when you pull the mobile phone data and do the same.

If you're believed to have committed a serious crime (and I don't mean a bit of fare evasion) then you're going to be worth the effort. E-ticket or not, it's not going to make a difference there.

Besides, aren't all ticket purchases recorded no matter what form or how they are paid for? I would assume there needs to be for accounting and planning purposes. The point remains that from a "privacy" aspect, there's already very little of it on the railway

 

[trainstrainstr]

You might not use the data in that way, but it doesn't mean that someone, somewhere either is doing so or might do so at some point in the future.

As I said upthread I do think there should be transparency about what data is stored, who has access to it, what it is used for, how long it is kept for etc. At the moment there appears to be nothing in the public domain about this at all.

Some large organisations don't have a great track record when it comes to looking after data. I'd like to think the railway would look after this sort of data properly but how can we be sure...

I could answer all those questions. I'm entirely responsible for exactly that. I know where data is stored, who has access, what it is used for, how long it is kept for - because I've authorised the use of it.

It's not in the public domain because its a small tiny piece of a vast jigsaw. But if someone were to contact me at work then I would be open about it. I can't speak for other TOCs but I work tirelessly behind the scenes to make sure data subject rights are at the forefront of decision making and I am constantly falling out with colleagues because I say no more than I say yes!

 

[zwk500]

Some large organisations don't have a great track record when it comes to looking after data. I'd like to think the railway would look after this sort of data properly but how can we be sure...

Isn't that the entire purpose of the Information Commissioners Office?

 

[Hadders]

I could answer all those questions. I'm entirely responsible for exactly that. I know where data is stored, who has access, what it is used for, how long it is kept for - because I've authorised the use of it.

It's not in the public domain because its a small tiny piece of a vast jigsaw. But if someone were to contact me at work then I would be open about it. I can't speak for other TOCs but I work tirelessly behind the scenes to make sure data subject rights are at the forefront of decision making and I am constantly falling out with colleagues because I say no more than I say yes!

It's reassuring to know that you take your responsibilities seriously but as you say you cannot speak for other TOCs and what they do.

Interesting that you are constantly falling out with colleagues over data subject rights. I see similar in my line of work and it's converning that many peeple simily do not understand the principles around keeping data secure, and when you can and when you can't have access to it.

 

[Haywain]

Interesting that you are constantly falling out with colleagues over data subject rights.

I think that’s a default for the role. In my experience we have to involve information security in all sorts of things but regard it as an inconvenience, at best, because they always have awkward questions. But those questions are because they are the professionals dealing with well meaning amateurs. And they always win!

 

[Lucan]

Google knows exactly where I've been. They send me a monthly report.

How do you get that? Did you request it, and if so how? I do use Google maps and it always opens up in Reading, which is nowhere near me. Do they think I am there? I don't correct them.

My preference would be for no adverts at all, but in reality there's only so much effort I make to avoid advertising.

I see no adverts on my PC unless I deliberately go to a merchant site. Arranging that did not take much effort.

There is sound psychology behind all high cost publicity and triggering petulent 'I'll never buy from a company that has adverts that irritate me' responses are part of the overall strategy of name and product awareness.

If an advert is annoying enough that makes me say (to myself) "I'll never buy etc ...", I fail to see why that does the company any good through me. I have always assumed that I am sufficiently off-beat that the adverts that annoy me are not aimed at me but rather at Mr Average, which I am not. For example there is a brand of beer (I won't mention the name) which I have never bought after seeing an annoying advert for it some years ago. I was already aware of the brand so it did not raise my "product awareness", nor do I discuss the brand with other people. I just automatically ignore the stuff - it's not hard, there are plenty of alternatives.

 

[Ken H]

There is a technique called jigsawing. You get bits of data from inconnected databases (illegally obtained and publically available data). And you look for matches. From that you build a profile of a person.
The data held by the railway might be small but joined with other data could result in identity theft.

 

[AM9]

How do you get that? Did you request it, and if so how? I do use Google maps and it always opens up in Reading, which is nowhere near me. Do they think I am there? I don't correct them.


I see no adverts on my PC unless I deliberately go to a merchant site. Arranging that did not take much effort.


If an advert is annoying enough that makes me say (to myself) "I'll never buy etc ...", I fail to see why that does the company any good through me. I have always assumed that I am sufficiently off-beat that the adverts that annoy me are not aimed at me but rather at Mr Average, which I am not. For example there is a brand of beer (I won't mention the name) which I have never bought after seeing an annoying advert for it some years ago. I was already aware of the brand so it did not raise my "product awareness", nor do I discuss the brand with other people. I just automatically ignore the stuff - it's not hard, there are plenty of alternatives.

Why do you think that every comment here is about you, or every marketeer is dedicating their budget to get your attention. To use a much hackneyed modern phrase, 'it's not all about you'.

 

[Runningaround]

How do you get that? Did you request it, and if so how? I do use Google maps and it always opens up in Reading, which is nowhere near me. Do they think I am there? I don't correct them.

You can use timeline too see where you've been, you can add your misses to it if she wants. The location will reset once you open up maps again too where you are now

I see no adverts on my PC unless I deliberately go to a merchant site. Arranging that did not take much effort.

You using AD-Blocker then?

If an advert is annoying enough that makes me say (to myself) "I'll never buy etc ...", I fail to see why that does the company any good through me. I have always assumed that I am sufficiently off-beat that the adverts that annoy me are not aimed at me but rather at Mr Average, which I am not. For example there is a brand of beer (I won't mention the name) which I have never bought after seeing an annoying advert for it some years ago. I was already aware of the brand so it did not raise my "product awareness", nor do I discuss the brand with other people. I just automatically ignore the stuff - it's not hard, there are plenty of alternatives.

Adverts aren't just being nice, the annoying ones are designed to stick in your mind, see the brand of beer you mention if the advert was forgettable you'd never had remembered the brand after all those years,
They must be affective as more companies are using annoying adverts

 

[MrJeeves]

As far as I know nothing about this is in the public domain.

Is it perhaps worth an FOI to one of the OLRs to ask about this info, it they have it?

Oops... Should have read further down...

 

[tomuk]

Is it perhaps worth an FOI to one of the OLRs to ask about this info, it they have it?

Oops... Should have read further down...

Is this what you were looking for?

Privacy Policy | TransPennine Express

Our Privacy and Cookie Policy sets out how and why we collect personal data from you and how it will be handled. Read our Privacy Policy and Cookie Policy.

www.tpexpress.co.uk

 

[MrJeeves]

Is this what you were looking for?

No, that's specifically the privacy policy for their site, it seems, and unrelated to this topic.

 

[tomuk]

No, that's specifically the privacy policy for their site, it seems, and unrelated to this topic.

It sets outhow they will handle your personal data including journey data.