We take protecting the privacy of our customers extremely seriously (How to keep data truly safe? Don’t collect it in the first place, 4 April). Aside from cases where it is essential that we know the identity of a holder of an Oyster card – such as when checking customers are entitled for free or discounted travel – there is no requirement for anyone to share their personal details with us.
For all cards, including those Oyster cards where proof of identity is required, we deliberately break the link in our systems between the card and the journeys made with it as soon as that link is no longer required for customer support, such as processing fare refunds.
Paying to top up an Oyster with a bank credit or debit card, or making a journey with a contactless payment card, does not result in us holding any personal data about that customer, in line with payment industry rules.
All customers have an option to register their personal details with us so that we can provide additional services, such as the ability to view their full personal journey history online. Such details are, of course, essential to ensure that we are only sharing that customer’s information. Any personal data given to us is never shared with anyone else, except where disclosures are made under highly prescribed circumstances, largely to law enforcement agencies where it is permitted by law or when the individual has given their consent.
Our only interest is in making travel in London as convenient and straightforward as possible, while protecting the privacy of our customers.
Lauren Sager Weinstein
Chief data officer, Transport for London
Jack Schofield says “The European Union’s General Data Protection Regulation (GDPR), which comes into force on May 25,will govern the storage and processing of data rather than its collection” (Ask Jack, theguardian.com, 29 March). However, the GDPR, just like its predecessor, the 1995 European Data Protection Directive, expressly covers the collection of personal information about us. The history of Europe in the 20th century shows the chilling risks inherent in the collection of names – and ethnic identities – on lists. The scope of data protection law is very broad, and for good reason.
Jon Baines
Data protection adviser, Mishcon de Reya LLP
Join the debate – email guardian.letters@theguardian.com