TfL needs to give passengers the full picture on WiFi collection scheme
When a device has WiFi turned on, it broadcasts a unique identifier called a MAC address. By tracking where they detect the MAC addresses of potentially millions of people’s devices a day, TFL want to analyse crowding and travel patterns to improve their services. TfL say they are not identifying individuals or monitoring browsing activity.
TfL are alerting to passengers to the scheme with this sign. (Text of the sign at the end of this blog.)
Unfortunately, it misses three crucial points to help passengers understand a) how the scheme works, b) all the purposes the data is being collected for, and c) how to opt out.
- TfL are tracking people’s movement around London and around stations
- Passengers have to turn off WiFi on all the devices they are carrying to opt out. If they leave WiFi switched on but never use the WiFi network, they will still be tracked.
- The data will be used to find and set prices for advertising spaces in stations, in addition to improving services
How to complain
If you don’t like this and want to complain, you can complain directly to TfL using Facebook, Twitter or email.
Tell TfL to ensure they they properly inform passengers:
- about how the scheme works and what they’ll use the data for;
- that passengers need to disable WiFi on all their devices to opt out.
The Information Commissioner’s Office (ICO) guidance on on WiFi location analytics says that:
- “Clear and prominent information is one way to alert individuals that certain processing is taking place.”
- “The information should clearly define…the defined purposes of the processing”
- “Data controllers should consider the use of:
- signage at the entrance to the collection area;
- reminder information throughout the location where data is being collected;
- information on their websites and in any sign-up or portal page of the Wi-Fi network they may be providing; and
- detailed information to explain how individuals can control the collection of personal data using the settings on their device.”
We will be asking the ICO for its view on the signage used by TfL to alert passengers to this scheme and whether it meets this guidance. We have already contacted TfL with the points made here.
There are a number of other issues with the way TfL has implemented this scheme.
It is very difficult for passengers to find out about the scheme beyond the limited information on TfL’s sign. The sign provides a link to tfl.gov.uk/privacy which is the Privacy Policy for the TfL website rather than their page about the WiFi data collection scheme. On a mobile screen – which nearly all passengers will be using in a station – the link to the page about the scheme is at the far bottom of the page. This is the page which includes all the details about what the data is being used for and how to opt out. It seems unlikely that many people will actually read this information.
Even if passengers turn off WiFi on their phone in an attempt to opt out, TfL may still track them using the MAC address broadcasted by tablets or laptops they are carrying. Many tablets and laptops, including Apple iPads and Macbooks, broadcast a MAC address when WiFi is enabled – even when the devices are in Sleep mode. While people may be able to easily disable WiFi on their phone, people will find it much harder to turn off WiFi on their laptop in a busy Tube station and so find it hard to opt out.
It is not clear that passengers are alerted soon enough or often enough about the scheme. The signs at London Bridge Underground station are placed near the ticket barriers. They were not placed at the entrances to the station or throughout the station. London Bridge is only one of the 54 stations which are part of the study and signs may be placed differently in other stations.
Passengers will be within range of TfL’s WiFi quite some way before seeing the signs and may not see the signs in the crowded ticket barrier area. Travellers who enter the Underground at a station which isn’t part of the scheme will be unlikely to see a sign and TfL may collect data about them without having informed them about the scheme.
To alleviate some of these issues, we would like TfL to:
- ensure they inform all passengers about the scheme
- inform passengers of all the purposes this data will be used for
- tell passengers to turn off WiFi on all the devices they are carrying if they want to opt out of the scheme
- ensure signs are placed at the entrances to stations and throughout the stations
ORG has previously warned of the privacy risks of TfL’s Oyster card system. Although the data in this new scheme is not linked to data in the Oyster system, it is clear that TfL has not lost its appetite for monitoring passengers.
Text of TfL’s sign
WiFi data collection
We are collecting WiFi data at this station to test how it can be used to improve our services, provide better travel information and help prioritise investment.
We will not identify individuals or monitor browsing activity.
We will collect data between Monday 21 November and Monday 19 December
For more information visit: tfl.gov.uk/privacy