A tap history is a travel diary, so keep it for weeks

When a rider taps a bank card or an agency card on one of our validators, the system records a small set of facts: a token standing in for the card, the time, the vehicle or station, and the fare charged. One tap says little. Linked together over months, and linked to an account with a name and an email address, those taps describe where a person lives and works, and when they visit a clinic, a place of worship or a former partner's street. A tap history is a travel diary that the rider never chose to write.

Account-based fare systems, which most Canadian agencies are now adopting, make that diary easier to keep. In older card systems much of the data stayed on the card itself. In account-based systems it lives in a back office, where it is useful, searchable and, unless someone decides otherwise, kept indefinitely. I think the default should be the reverse: identifiable tap records kept for weeks and then aggregated, with longer retention only by a decision made in public.

What account-based fares quietly collect

It is worth being exact about what is collected, because the debate tends to swing between alarm and dismissal. A bank card tapped without an account produces a token that the agency cannot link to a name, but it can link every trip made with that card. Once a rider registers the card to see their history or claim a refund, the trips become identified. Agency cards issued to students, seniors and low-income programmes are often registered by design, because eligibility has to be checked. So the riders with the most identified travel are frequently those with the least choice about it.

Trip planners add another layer. A rider who lets the app use their location shares where they are standing and where they are going. That is needed for the journey. It is not needed afterwards.

In most of our contracts the agency is responsible for this information under provincial public-sector privacy law, and we handle it on the agency's behalf. The laws differ by province, and Quebec's were substantially strengthened between 2022 and 2024, with privacy impact assessments now expected for projects of this kind. As far as I know, none of them sets a single retention period for tap records. They ask instead for necessity and proportion. That leaves the default to the vendor's design and the agency's procurement, which is to say, to people like me.

The analysts' case for keeping everything

The argument for long retention is not frivolous, and our own data team made it to me with care in 2022. Planners use linked trips to understand transfers, to see how a route change affected real people over a year and to model demand for new services. Fare investigators use history to resolve disputes. Riders ask for records going back months, to claim travel expenses from an employer or to check a charge. And some agencies receive requests from police, which they handle under their own legal obligations.

I tested each use against what it actually requires. Planning almost never needs to know who a rider is; it needs trips that can be linked for long enough to see patterns. We can provide that with aggregated, de-identified data built before the identifiable records are deleted, using linkage keys that change regularly so that no long-term profile of a person survives. Disputes and refunds are nearly all raised within a few weeks. Riders who need a longer record can download it, and the app now prompts them to do so each month. That left the requests from police. Data that has not been kept cannot be produced, and I think an agency is better placed explaining a short retention policy adopted in public than explaining why it holds years of identifiable trips it did not need.

The data team's remaining concern was lost research value, and it is real. Some analyses, such as following the same riders through a multi-year network redesign, become harder. We have offered agencies a structured alternative: a research panel of riders who consent to longer retention for a defined study, with the agency's own review of its purpose and safeguards. Two agencies have used it. Most have not, which suggests that the need was smaller than the fear of losing it.

A default an agency can defend in public

Since 2023 Halvery's defaults have been these. Tap records linked to an identified account or a registered card are kept in identifiable form for 60 days, then reduced to aggregated, de-identified data. Tokens for unregistered bank cards are rotated so that trips cannot be linked beyond the same period. Trip-planner location is used for the journey and not stored against an account. All rider data is held in Canada. An agency that wants longer retention can have it through a written decision stating the purpose and the period, which we help it publish.

Most of our 31 fare customers have kept the default. Several chose 90 or 180 days after consulting their own privacy officers, and I think those are defensible choices. One chose to keep identifiable records for seven years, citing its audit obligations. We supported that, as the contract allowed, and asked that the decision be published. It was.

The cost to Halvery is modest but real. We lost one competition in 2024 partly because a rival offered unlimited retention as a feature, and our analytics products are harder to build on short-lived data. The benefit is harder to count, because it is the absence of an event: a breach that exposes less, a request that finds nothing, a rider who never has to learn how much the transit system knew about them.

For agency boards, the question is brief. How long does the system keep a record of where an identified rider went, and who decided? If the answer is indefinitely, and nobody decided, the board is keeping a travel diary it never meant to keep.