Passenger privacy Data and TBSs Third-party digital booking apps have the capacity to collect certain data from passengers, including the location of registered app users’ smartphones, even when the registered user has not requested a ride or a ride is not underway. Further some apps have the ability to send promotional information to registered users and their friends who are connected to the registered user through internet-based social sites. Finally, some booking apps may also collect the means and content of communications (calls and SMS) between drivers and passengers. The capacity of booking apps to collect data like that described, and additional types of data would be expected to increase over time, and such apps may be in common use across all types of public passenger transport. All applicable federal and ACT privacy laws will operate. Electronic commerce Electronic payment processing for trips is an essential component of third-party digital booking apps, and also for non-cash transactions undertaken within taxis and hire cars. Passengers’ submission of bank-card and other personal information upon registering with TBSs, and individual transaction information carries privacy implications similar to those described above. Such activity is expected to be subject to the above Acts, where applicable, but also to Australian and international standards specific to electronic financial transactions. This includes the international Payment Card Industry Data Security Standards (PCI-DSS, which covers the appropriate usage of branded credit cards. A TBS will therefore need to comply with the following: Privacy Act 1988 (Cth) Electronic Transaction Act 2001 (ACT), which covers aspects of the transmission of data, including personal information, and the signing of contracts electronically PCI-DSS. TBS information to drivers and passengers Operators and drivers, as independent contractors, would not fall within the privacy requirements placed on TBSs, including NPPs. TBSs will therefore need to limit information to that necessary for the conduct of the transaction (as noted in section 7.2.4) or have arrangements in place to maintain privacy. For example, information is not to include names but will instead use independent identifiers such as booking numbers and public passenger drivers licence numbers. Data and ACT Public Agencies Data collected by TBSs may routinely be shared with ACT Government agencies in their capacity of ongoing regulators and law enforcement. Further, TBS data will be important to
Passenger privacy Data and TBSs Third-party digital booking apps have the capacity to collect certain data from passengers, including the location of registered app users’ smartphones, even when the registered user has not requested a ride or a ride is not underway. Further some apps have the ability to send promotional information to registered users and their friends who are connected to the registered user through internet-based social sites. Finally, some booking apps may also collect the means and content of communications (calls and SMS) between drivers and passengers. The capacity of booking apps to collect data like that described, and additional types of data would be expected to increase over time, and such apps may be in common use across all types of public passenger transport. All applicable federal and ACT privacy laws will operate. Electronic commerce Electronic payment processing for trips is an essential component of third-party digital booking apps, and also for non-cash transactions undertaken within taxis and hire cars. Passengers’ submission of bank-card and other personal information upon registering with TBSs, and individual transaction information carries privacy implications similar to those described above. Such activity is expected to be subject to the above Acts, where applicable, but also to Australian and international standards specific to electronic financial transactions. This includes the international Payment Card Industry Data Security Standards (PCI-DSS, which covers the appropriate usage of branded credit cards. A TBS will therefore need to comply with the following: Privacy Act 1988 (Cth) Electronic Transaction Act 2001 (ACT), which covers aspects of the transmission of data, including personal information, and the signing of contracts electronically PCI-DSS. TBS information to drivers and passengers Operators and drivers, as independent contractors, would not fall within the privacy requirements placed on TBSs, including NPPs. TBSs will therefore need to limit information to that necessary for the conduct of the transaction (as noted in section 7.2.4) or have arrangements in place to maintain privacy. For example, information is not to include names but will instead use independent identifiers such as booking numbers and public passenger drivers licence numbers. Data and ACT Public Agencies Data collected by TBSs may routinely be shared with ACT Government agencies in their capacity of ongoing regulators and law enforcement. Further, TBS data will be important to
Supporting-Analysis-Paper-public-updated20112015.docx