Our Ref:         FOI-2125-1920

Thank you for your request received on 15 October 2019 asking for information about the WiFi Data Insights Project.
 
Your request has been considered in accordance with the requirements of the Freedom of Information Act and our information access policy. I can confirm we do hold the information you require. You asked for:
 
With reference to the document linked, the DPIA for the WiFi data collection > http://content.tfl.gov.uk/data-protection-impact-assessment-routine-collection.pdf
 
9.1 “TfL formally wrote to 6 external and high profile privacy campaign groups asking them if they would like to meet with TfL to discuss our project.”
 
11. Privacy groups and Assembly members recommended that for future rollout that the posters explicitly state how to opt-out. ”
 
Please can you provide:
 
a.    The 6 external and high profile privacy organisation names
 
Please note that there is an error within the published Data Protection Impact Assessment (DPIA), as four privacy organisations were approached, not six. Those organisations were: Big Brother Watch, Liberty, Open Rights Group and Privacy International. In addition to these privacy groups we also contacted London TravelWatch, the Information Commissioner’s Office (ICO), and Sian Berry, Assembly Member.
 
b.    The recommendations made on opt out
 
The Chair of the GLA’s Oversight Committee (Len Duvall) sent a letter to the Mayor in November 2017 to report on the Committee’s investigation into the use of personal data across the GLA Group. That investigation had included consideration of our Wi-Fi pilot and the letter includes the Committee’s recommendation on what customers should be told in future about how to opt-out:
 
“Before this technology is rolled out across the tube network, however, we would ask you to ensure that TfL addresses two key concerns discussed at our meeting: Customers need to be made more aware that TfL is monitoring their Wi-Fi connections while on the network and given simple instructions on how to opt out. In particular, signage and announcements at tube stations should advise people to simply switch their Wi-Fi off if they do not wish to be monitored.”
 
Len Duval’s letter is published on the GLA website (under ‘Related documents’):
 
https://www.london.gov.uk/about-us/london-assembly/london-assembly-committees/gla-oversight-committee
 
There was not a similar written recommendation from the Privacy groups we consulted but both Big Brother Watch and Open Rights Group attended the Committee’s hearing in September 2017 and one or both expressed their views. The transcript is also published:
 
https://www.london.gov.uk/moderngov/ieListDocuments.aspx?CId=254&MId=6310&Ver=4
 
c.    Confirm whether any children's rights organisations were engaged
 
No organisations specifically focused on children’s rights were engaged. However, it is important to note that we have no way of identifying whether it is a child or an adult carrying a mobile device on the network.
 
d.    Confirm how many occasions since i. the pilot and ii. implementation any non-TfL third party has made a request for access to data collected
 
Statistics for the pilot (November 2016 – June 2019):
• Subject Access Requests (SARs) made under data protection legislation – 2 requests
• Freedom of Information (FOI) requests - 0 requests
• Requests received from the police and other law enforcement bodies – 0 requests
 
Statistics post-implementation (July 2019 – onwards):
• Subject access requests (SARs) made under data protection legislation – 3 requests
• Freedom of Information (FOI) requests - 1 request
• Requests received from the police and other law enforcement bodies - 1 request (Metropolitan Police)
 
e.    Confirm how many occasions since i. the pilot and ii. implementation any non-TfL third party has been granted access to data collected
 
Post-implementation TfL shares aggregate data with our advertising partner, Global. Data shared with Global consists only of estimated numbers of people (e.g. walking past an advert at different times of the day), never of data related to individual journeys. The SAR, FOI, and Metropolitan Police requests for information on the movements of a particular mobile phone have been refused on privacy grounds.
 
f.     Confirm which types of individual or aggregated data items have been made available (whether by view access or data distribution) to those third parties
g.    Provide a list of which requestors (organisation names) have been granted and/or denied access to which types of data items
 
The aggregate data made available to Global currently consists of the following:
 
•         Station code and name
•         Station origin and destination area nodes – nodes are locations with a station (eg a corridor, a platform, part of a platform, etc). Each row of data provided to Global represents the number of people moving between one node and the connecting node
•         Date
•         Time (in 15 minute intervals)
•         Inferred volume –any volume less than five will be zeroed out
 
h.    Confirm whether or not TfL is maintaining a register of data access, distribution and purposes of use by requestor.
 
Whilst not currently maintaining a register specifically for Wi-Fi access requests, TfL does maintain trackers for both subject access requests and requests received from the police and other law enforcement bodies.
 
If this is not the information you are looking for, or if you are unable to access it for some reason, please feel free to contact me.
 
Please see the attached information sheet for details of your right to appeal.
 
Yours sincerely

Gemma Jacob
Senior FOI Case Officer
FOI Case Management Team
General Counsel
Transport for London

[email protected]