We have had an enormous amount of complaints in regard to the information that the CPVV has requested from the taxi and hire car industry. Today we wrote to the Information Commissioner and the Privacy and Data Protection Deputy Commissioner about these concerns and wait with anticipation for their response.
RE: Information, privacy and data protection concerns over Commercial Passenger Vehicle Industry data collection requirements.
I am writing to express my concerns regarding the information demanded of industry stakeholders by Commercial Passenger Vehicles Victoria (CPVV,) regulator of the Commercial Passenger Vehicle Industry.
Specifically, I question the justification supporting the CPVVs request for information from Booking Service Providers (BSPs) of commercial passenger vehicles as well as the quantity and nature of the data that BSPs are expected to produce. It is not entirely clear why all the information is needed or the way in which the information is intended to be used.
Under the current regulations, all BSPs are required to keep records of trip data outlined in Schedule 1 of the Commercial Passenger Vehicle Industry Regulations 2018 which came into effect on July 2, 2018. The data includes things such as the kilometres travelled and amount charged for the trip, the date and time of the booking request and the date, time and GPS coordinates (or address) of where the trip started and ended. It is a condition of maintaining BSP registration to keep records of all booked trips and to report some or all the information to the CPVV upon written notice.
Similar records are to be kept of unbooked commercial passenger vehicle services as outlined in Schedule 2 of the Commercial Passenger Vehicle Industry Regulations 20182, however, this data has not been requested by the CPVV at this time.
While the regulations may outline record keeping requirements, it has only recently come to light that the CPVV intends to request data en masse outside of any specified incident or complaint and at regular intervals, either monthly, quarterly or half-yearly. BSPs are deeply concerned about how the wholesale collection of such data will be used and protected and how a passenger’s identity could potentially be exposed. More importantly, there is understandable trepidation in providing the requested data without confirming whether there is a need to obtain a client’s consent to share the required details of their trip with the regulator and for the regulator to use that information in the way they intend.
While the trip is de-identified in that names of passengers are not provided, with provision of trip GPS coordinates or address details, much of the data being requested of BSPs could be easily linked to an individual, their home address and their movements, particularly if the trips have some regularity.
The data could rightly be considered personal and private information relating to the activities of clients engaging commercial passenger vehicle services. This is causing undue conflict and anxiety for BSPs who are concerned about client privacy and their own accountability both to the regulator and to their client.
These concerns are further complicated by the threat of a fine which may be imposed if BSPs fail to provide all the information in question by the due date and in the required format. Body corporates can be fined up to $99,132 and individuals $19,826. These fines are not insignificant and should not be enforced until it is determined whether there is sufficiently strong reason for BSPs to withhold some or all the requested information on privacy grounds.
Additionally, many BSPs, particularly those who operate in the private hire sector, such as limousines, are uneasy providing commercially sensitive information regarding their service fees and charges. There is extreme reluctance from the industry to divulge such information without a clear understanding of why this is needed and how this will be used by the regulator.
Considering the principles of the Privacy and Data Protection Act 2014 (PDPA), it simply does not appear reasonable or necessary that the CPVV have access to the precise details of passenger movements or have intimate knowledge of what a business may charge it’s private clients.
The CPVV states that this data is critical to enhance industry safety. The regulator further explains that incomplete information hinders their ability to design regulatory responses that reflect the entire industry.2
This would be plausible if not for the fact that a significant proportion of vehicles registered within the industry operate outside any affiliation to a booking service provider. Furthermore, for those owners who may operate only one or two vehicles there is no requirement to register as a BSP even if they accept bookings. While records must be kept for all booked and unbooked services, at this point in time, it is only booked services provided by registered BSPs which must be reported on and not all booked trips or trips initiating from a rank or hail (unbooked). These can account for upwards of 50% of trips annually within the industry.
If safety is being used to justify the need to collect this information from BSPs, would it not be imperative to collect the information from all industry participants and for every trip conducted across all market areas?
This is particularly so given the safety risk associated with independent operators who are by and large unknown to the industry regulator and fly beneath the radar. The regulator is oblivious to which commercial passenger vehicle owners and drivers operate independently or those who are affiliated with a BSP.
Despite numerous inquiries by BSPs to the CPVV, no information has been forthcoming explaining how this data will be used to enhance industry safety or how the CPVV plans to protect the data. This must be made expressly clear to the industry prior to data collection.
Passengers provide their addresses to BSPs with the belief that this information will be used solely for the driver to pick up and drop them off. It is unclear whether BSPs require passengers to provide their consent to having the details of their travels shared with the regulator or used in the way the CPVV intends. BSPs are rightly concerned about breaching the privacy of their clients without their consent or knowledge.
As such, does the CPVV not have an obligation to inform passengers and BSPs, about what they plan to do with the personal information they collect?
Also, has any consideration been given to what would happen in the event that a passenger does not consent to having their personal information shared with the regulator? Are BSPs required to reject such bookings for fear that they may fall short of the requirement to submit the associated trip data and therefore become liable for hefty fines?
There are also other considerations relating to fairness which must be addressed in mandating reporting requirements of this nature and in a strict and specified format. There are many smaller industry operators who do not have the capacity or technology required to record, maintain and submit this information.
Around the 16 December 2020, the CPVV requested data from BSPs spanning the period 1 July 2020 – 31 December 2020 with a due date for provision of the data in a prescribed format by 15 January 2021. At the time of notification, the portal for data upload was not operational and the exact format requirements for the data were unknown to the industry.
While compliant BSPs would be collecting in some format the information as required, the timeframe in which the data was demanded by the CPVV is remarkably short. This is particularly so spanning the Christmas period and in the context of a pandemic where administrative resources have been stretched. Correspondence from the regulator has informed that some BSP’s are expected to report this information monthly.
For those who record their trips on paper or by some other rudimentary means, collating this information and transferring it to an online platform in a specified format is a considerable undertaking bearing in mind the precise format requirements of the data have only recently been finalised. Many in the industry have informed me that they will need to retrospectively and manually modify the data they have collected to meet formatting criteria and in some cases simply do not have the technical expertise to submit the data at all in the stipulated format.
Larger BSPs such as the major taxi networks and rideshare giants have technological resources to automate the manipulation of data they have collected into the required format with ease. Without a large investment in technological capability to process historical records to meet with specific formatting criteria or investing considerable time to laboriously format data manually, many smaller BSPs are being pushed to the wall. Then there is also the compounding threat of a considerable fine. The request for recorded information with such a short turnaround and with no prior instruction regarding the format for data records is simply heavy handed, unreasonable and unfair.
Where do we draw the line between requesting data and threatening to cripple commercial passenger vehicle service providers who simply cannot afford the technology required to comply with the data demands?
Balance and transparency are found wanting in this instance. There is a clear advantage for the corporate giants within this industry as compared to the imposition on smaller operators to comply with the regulations. This, along with the risk of the associated fine for non-compliance, will undoubtedly lead to further industry monopolisation. The effects of this will be most profound in rural and regional areas which rely more heavily on commercial passenger vehicle services yet are not considered lucrative markets for the corporate giants to service. They may be left without transport services entirely.
After the financial devastation experienced following the compulsory acquisition of perpetual taxi and hire car licenses in 2017 without compensation, compounded by the COVID-19 pandemic, those in the industry are simply struggling to comply with such crippling regulation and information demands.
The sector being threatened with fines are the same individuals who are in mountains of debt after their expensive taxi licenses were suddenly worth nothing. An element of paranoia exists for those smaller entities who feel that they are being targeted at the expense of the prosperity of larger corporations.
I believe this regulatory burden and the threat of such enormous fines could be the nail in the coffin for the many small businesses operating in the taxi and hire car industry.
On behalf of concerned BSPs and passengers alike, I urge the Office of the Victorian Information Commissioner to intervene and seek to obtain answers from the CPVV justifying how the requested information supports industry safety as they claim. Particular so when the information is only being collected from a subsection of the industry and not comprehensively from all participants and market sectors – both rank and hail and private hire through registered BSPs as well as smaller independent operators.
Further investigation is urgently needed to determine if the requested data and information amounts to an overreach of what is necessary to achieve the intended objectives of the CPVV. Additionally, whether demanding information from only a defined subset of the commercial market and from a select participant group is truly reflective of the industry as a whole and can confidently support industry wide conclusions.
I also seek guidance and advice on the matter of passenger privacy and whether a BSP may be in breach of client confidentiality by sharing their personal trip data with the regulator for any purpose without their consent.
Lastly, I ask you to explore whether the requirement for BSPs to provide information relating to distance and cost charged for each trip may infringe on their right to retain such information as commercial and in confidence.
I look forward to your prompt reply.