MyWay+ privacy
1. Background
1.1 MyWay+ system
Transport Canberra provides an electronic account based ticketing system (MyWay+ system) for travel on public transport in the ACT. The MyWay+ system uses a MyWay+ travel card for ticketing and/or payment. A MyWay+ travel card includes:
- a contactless smart card which is a physical MyWay+ travel card or a MyWay+ digital card (QR Code)
- an approved payment device (device) such as a contactless credit card, debit card, prepaid card, smartphone, or other device which can emulate a contactless payment card.
These cards function as an electronic wallet from which fares can be deducted and “topped up”. The NFC chip component of all MyWay+ physical travel cards is read when tapping on or off at MyWay+ card readers installed in or around public transport locations or vehicles.
MyWay+ travel cards and EMV cards use the chip embedded in their device to perform the same function. These chips can also be read by devices used by Transport Officers as part of revenue protection activities. Users of these cards can travel as either account holders or ‘anonymously’.
By registering for MyWay+ users set up an account which they can use to manage MyWay+ services, including travel cards, personalised journey planning, Park and Ride permits, and concession status. Account holders can link different cards to the same user account and funding source.
1.2 Types of MyWay+ accounts
MyWay+ users have a choice of channels for creating an account. They can use or create an ACT Digital Account through the MyWay+ portal or app. The user would also need to grant permission for that account to be used in conjunction with the MyWay+ service.
The benefit of using an ACT Digital Account is that the account can be reused for other ACT Government services as the information provided can be made available to those other services if permission is granted by the user.
Alternatively, a user can create a local MyWay+ account which can only be used for MyWay+ as the account information is retained within the MyWay+ service and not shared with other government agencies.
1.3 How to acquire MyWay+ travel cards
Under the MyWay+ system users are able to acquire MyWay+ travel cards through various channels including via portal, the Transport Canberra Customer Experience Team, approved retailers (ePay), and through the MyWay+ app.
2. Scope of policy
2.1 Relationship to Transport Canberra privacy policy
This policy is intended to serve as an addendum to the Transport Canberra information privacy policy which can be accessed on this page.
This policy covers customers who use the MyWay+ system. A reference to a “customer” is a reference to any person who uses the MyWay+ system including any person who uses a MyWay+ travel card acquired for them by another person.
It also covers the MyWay+ portal and app available for download via the App Store or Google Play (MyWay+ travel app).
2.2 Incremental introduction
The MyWay+ system is being continually developed and new elements are introduced progressively over time. The provisions of this policy relate to the elements that have been introduced to date.
The policy will be reviewed and updated as required when new elements are introduced.
2.3 Amendments
Transport Canberra may make amendments to this privacy policy and our information handling practices from time to time. We will publish those changes on this page, and update this privacy policy as required to ensure compliance while considering our users expectations at the time personal information was collected.
3. Personal information and the MyWay+ system
3.1 Collecting personal information
MyWay+ collects, stores, discloses and uses information relating to customers, some of which is personal information.
Some of the information being collected, when taken on its own, may not be personal information. For example, travel history alone does not allow an individual to be identified. However, it can be linked to customer details that we hold.
3.2 Purpose of collection
Transport Canberra will be collecting information that is necessary for the purpose of:
- managing and operating the MyWay+ system
- supporting our responsibilities for coordination, planning and policy development for transport, transport services and transport infrastructure
In so doing, information collected will be used to:
- provide services and support to users including services related to MyWay+ travel card ordering, setting up payment or notification preferences, adding value to MyWay+ travel card balances, personalised journey planning and viewing travel history
- supply physical MyWay+ travel card to customers
- manage fare calculations and associated transactions
- determine your eligibility for discounted parking in a Park and Ride car park
- support the administration and management of public transport concessions
- maintain and operate the MyWay+ portal and app
- undertake planning, reporting, policy development and statistical analysis for transport, transport services and transport infrastructure
- engage in marketing and disseminating information regarding services and products to customers who choose to receive such information
- support the provision of secure, effective and efficient transport services, including measures to protect public revenue and
- carry out surveys to obtain customer feedback.
3.3 Open Data
De-identified (non-personal) MyWay+ usage data may be released to the public in accordance with and to meet the objectives of the Transport Canberra Open Data Policy and the broader ACT Government Open Data Policy.
MyWay+ data released as Open Data does not contain any personal information and will only be released after assessing any risk of potential re-identification and taking steps to address that risk.
4. MyWay+ travel cards and information collected under the MyWay+ system
4.1 MyWay+ travel cards
MyWay+ travel cards are a form of ticketing and payment for travel on public transport in the ACT. Each card has its own unique card identification number. The physical MyWay+ travel card number is stored on the chip of the card.
The MyWay+ travel card number is used in routine communications with customers through channels such as Transport Canberra Customer Experience team or through interactions with Transport Canberra staff.
Although the MyWay+ travel card does not store a customer’s personal information, we are able to connect the MyWay+ travel card number to the customer’s details that are held relation to a registered MyWay+ travel card. This is not the case for unregistered non-concessional MyWay+ travel cards.
4.2 Devices
Devices may be used as a form of ticketing and payment for travel on public transport by validating the device on approved MyWay+ travel card readers on which the device is an accepted form of fare payment.
If you use a device to pay for travel on the MyWay+ ticketing system, Transport Canberra may use your personal information to provide you with journey and charging history associated with your device and to respond to any specific enquiries you may have regarding the use of your device to pay for travel.
Information about a device is encrypted and stored in accordance with payment card industry security standards.
4.3 Collection of information
The nature of the personal information that Transport Canberra collects under the MyWay+ system and the way it is collected depends on the type of MyWay+ account, how a customer acquires, adds value to or uses their MyWay+ account, and whether the account is registered or unregistered.
In relation to registered MyWay+ account holders, Transport Canberra only collects information that is reasonably necessary for the purpose of providing and managing the MyWay+ ticketing system. We rely on users to provide us with accurate and up to date personal information.
4.3.1 Unregistered accounts
Customers are able to acquire physical MyWay+ travel cards through MyWay+ retailers without creating an account. In such circumstances, customers will obtain immediate possession of the physical MyWay+ travel card and neither Transport Canberra or the MyWay+ retailer will collect any personal information from the customer at that point.
Refer to section 4.3.3 for details of information collected when value is added to an MyWay+ travel card.
4.3.2 Registered accounts
When a customer creates a MyWay+ account, a customer profile is created that is then linked to that MyWay+ travel card. In creating a customer profile, Transport Canberra collects the following information:
- the customer’s first name and last name
- email address (which is the username)
- their username
- their password and
- the customer’s mobile number (optional).
If a customer wishes to purchase a physical MyWay+ travel card through a digital channel, then their address is also collected and used only for the purpose of shipping.
4.3.3 Information collected when the MyWay+ travel card is used
Transport Canberra collects information about journeys made with a MyWay+ travel card in order to account for fares charged, to make payments to transport operators and to manage the MyWay+ ticketing system. The information collected with respect to each MyWay+ travel card includes:
- the MyWay+ travel card number of the card that is used
- the time and date of tap on and tap off of the MyWay+ travel card
- start and end location
- route identifiers
- journey transfers (if any)
- the discount (if any) and
- the fare charged on the MyWay+ travel card.
Further, the information collected when a customer adds value, or 'tops up' a MyWay+ travel card includes:
- the location or channel through which value was added to the MyWay+ travel card
- the amount of the transaction and
- the date and time of the transaction.
If a customer chooses to register for Park and Ride Transport Canberra will also collect number plate details for each vehicle the customer links to their Park and Ride account.
4.3.4 Services available for MyWay+ accounts
MyWay+ accounts enable customers to obtain activity statements, personalise their journey planning, manage payments and establish an auto-load facility for their linked MyWay+ travel cards.
To enable customers to do these things, Transport Canberra will retain the personal information necessary to provide such services and facilities. If a customer wishes to manage such services and facilities online, the customer must provide their username and password connected to their customer profile.
4.3.5 Linking MyWay+ travel cards to a MyWay+ account
Within the MyWay+ system customers have the ability to link one or more MyWay+ travel cards so that they can conveniently manage the usage, payment and information connected to those cards under one customer profile.
When customers establish linked MyWay+ travel cards, Transport Canberra links their specific customer profile to:
- the MyWay+ travel card
- information about how, when and where those MyWay+ travel cards have been used.
4.3.6 Adding value to a MyWay+ travel card
When a customer adds value to a MyWay+ travel card (whether linked to an account or unlinked) by using a credit card or debit card, the customer will be providing personal information required for making a credit card or debit card payment.
Transport Canberra does not retain identifiable payment card information. This information is instead passed directly to the relevant financial institution for processing.
4.3.7 Refunds or balance transfers and adjustments
Customers are entitled to obtain a refund, transfer, or adjustment of the balance of their MyWay+ travel card in certain circumstances. To enable Transport Canberra to respond to the customer’s requests for a refund, balance transfer or balance adjustment, we may obtain personal information (normally, a name, contact number, address, and/or email address) from the customer.
4.3.8 MyWay+ travel concession cards
The MyWay+ system accommodates various concessions that depend on a customer’s fare entitlement status. These concessions are subject to the terms and conditions outlined on the concessions page.
4.3.9 Contacting customers
If a customer provides Transport Canberra with a contact number, address or email address, the customer consents to us using that information to contact them and communicate with them for the purposes stated in section 3.2. This includes us contacting the customer in the event that we have an issue (such as billing or the processing of a transaction) relating to the MyWay+ ticketing system.
4.3.10 Enquiries or complaints
Personal information (normally a name, contact number, address, and/or email address) will be obtained from a customer to enable Transport Canberra to respond to the customer’s enquiries or complaints.
5. Use and disclosure of personal information
5.1 Use of personal information
Transport Canberra will use the personal information we collect for the purposes set out in section 3.2 and as otherwise set out in this policy.
5.1.1 Contractors
Transport Canberra engages contractors to deliver aspects of the MyWay+ system on our behalf. We need to exchange personal information with those contractors. The main contractor engaged to implement, manage and operate the MyWay+ system is NEC Australia.
Transport Canberra is responsible for ensuring that contractual arrangements with these and other contractors include appropriate privacy provisions to protect customers’ personal information and enable us to meet its obligations under privacy law.
5.2 Disclosure to third parties
Personal information about customers may also be disclosed to third parties with the customer's consent, or in the following circumstances in accordance with the Transport Canberra privacy policy.
5.2.1 A bank or financial institution
For customers who top up online, buy a QR ticket, establish an auto-load facility, or who purchase a MyWay+ travel card, their account information is provided to financial institutions to facilitate payments.
5.2.2 Research organisations
De-identified information may be disclosed to research organisations for the purpose of analysing data about our services to assist in improving the delivery of our functions and activities.
Public transport operators may also obtain de-identified information from us for the purposes set out in section 3.2 which includes planning and management purposes.
5.2.3 Revenue protection
Authorised revenue protection officers are responsible for enforcing ticketing compliance and monitoring public transport fare evasion. Some of them will be using handheld MyWay+ travel card readers to read the travel card balance, recent transaction history and the concession status.
If required, we and/or they may combine this information with other personal information obtained directly from a customer to generate a compliance report for enforcement purposes.
These officers may also check the travel history connected to a customer’s concessional or free travel MyWay+ travel card to ascertain whether that customer has complied with the travel conditions or rules applicable to the use of that concessional or free travel MyWay+ travel card.
5.2.4 Law enforcement
Transport Canberra may disclose personal information or travel history for law enforcement purposes.
5.2.5 Requirement by law
Transport Canberra may disclose personal information to third parties when permitted or required to do so by law. For example, we may disclose personal information in response to a warrant or subpoena.
5.2.6 Threat to life or health
Transport Canberra may disclose personal information to third parties where we reasonably believe that disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of a person.
5.2.7 Contactless payments
To process a customer refund for MyWay+ system travel paid for with a device, Transport Canberra will need to disclose certain de-identified information about the device and the transaction to the issuing financial institution. The information disclosed to the issuing financial institution will be encrypted.
While the device and the transaction information is not personal information, the payment card scheme is designed so that the issuing financial institution may re-identify the customer through cross-matching with personal information already held by the issuing financial institution (as the customer is the issuer’s customer), in order to correctly attribute the expenditure to the customer.
6. Accuracy, data storage and security
6.1 Reliance on customer for accuracy of information
While Transport Canberra can take such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which it is to be used, the information collected is relevant, correct, not misleading and up to date. Transport Canberra will be relying on customers to provide accurate and up to date personal information. It is in each customer’s best interests for their address to be correct, for them to be readily contactable and for there to be clarity over their identity or personal information.
The steps Transport Canberra take in the collection of personal information include training staff about collection of personal information from customers and adopting processes for customers to update or correct their personal information.
6.2 Data storage
Personal information on the use of MyWay+ travel cards will be stored in various databases within the MyWay+ system as required under by the Territory Records Office. Personal Information is encrypted when it is stored in these databases.
Data stored within the MyWay+ app is encrypted using the encryption algorithms that are part of the device’s operating system.
6.3. Data in Transit
Data is encrypted using standard HTTPS / TLS security mechanisms when it is transmitted from one part of the MyWay+ system to another, or when it is disclosed to third parties.
6.4 Security
Transport Canberra is committed to protecting the privacy and security of the personal information provided to us. Relevant industry standards are adopted to protect customers’ personal information from misuse, loss and unauthorised access, modification, or disclosure.
Customers are also required to assist by complying with security measures designed to protect their MyWay+ travel cards, usernames (and other identification codes) and passwords that are set out in Transport Canberra terms fare conditions.
7. Online
7.1 Collection of information via MyWay+ portal and app
7.1.1 MyWay+ portal
Transport Canberra collects information using cookies on the activity on the MyWay+ portal. Information about cookies is in section 7.2 below.
7.1.2 MyWay+ app
Transport Canberra collects personal information from registered MyWay+ users who provide and/or update their personal information through the MyWay+ app.
Transport Canberra collects cookies and other metadata about the activity of users through the MyWay+ app. Information about cookies is in section 7.2 below.
Transport Canberra does not collect any health information or sensitive information via the MyWay+ app.
7.1.2.1 Location Data
The MyWay+ app makes use of location data to enhance the trip planning service. Customers can turn off this functionality at any time by turning off the location services settings for the MyWay+ app.
7.2 Cookies
A ‘cookie’ is a packet of information that allows the server (the computer that hosts the website) to identify and interact more effectively with the customer’s computer.
When a customer uses the MyWay+ portal or ap, we send them a cookie that gives them a unique identification number. A different identification number is sent each time the MyWay+ portal or app issued. Cookies do not identify individual users, although they do identify a user’s browser type and the customer’s Internet Service Provider (ISP).
Customers can configure browsers to accept all cookies, reject all cookies or notify them when a cookie is sent. Customers can refer to browser instructions or help screens on the computer to learn more about these functions.
7.3 Purpose of collection
7.3.1 Cookies and other metadata
Cookies and other metadata obtained through the MyWay+ portal or app is collected and used to evaluate how users interact and use the MyWay+ system and so that we can assess and improve the effectiveness of these services.
7.3.2 Other MyWay+ app information
MyWay+ app information is collected by us for the following purposes:
- to facilitate your use of the MyWay+ travel cards and the MyWay+ app
- to facilitate your ability to manage and update your MyWay+ account details such as your address details.
No access is required, nor data collected from a mobile device's camera, microphone, nor image library.
7.4 Links to other websites
The MyWay+ portal or app may contain links to other external websites. Whilst such links are provided for convenience, customers should be aware that the information handling practices of the linked websites might not be the same as Transport Canberra’s.
8. Access to personal information
8.1 Accessing and correcting personal information
Customers can access, review, or correct the below personal information by:
- logging into their MyWay+ account and following the procedure for accessing, reviewing, and correcting their information contained in their customer profile - if they have established an online MyWay+ account
- logging into or accessing the MyWay+ app as detailed below
- contacting the Transport Canberra Customer Experience team to access, review or correct the above personal information and any other personal information and/or health information collected or obtained by Transport Canberra in connection with the MyWay+ system
- customers may be asked questions about their account or to provide other information to identify themselves before being allowed to access, review or correct their personal information.
Transport Canberra will enable customers to access and/or correct personal information and/or health information in accordance with the Transport Canberra privacy policy.
8.2 Notifying customers about security breaches relating to privacy
Transport Canberra takes reasonable steps to protect personal information from loss, unauthorised access, unauthorised use or disclosure. In the event of a security breach that affects a customer’s personal information, we will act in accordance with the Act Government wide procedure for responding to privacy breaches involving personal information
