The new ORCA transit fare card raises questions about privacy. For instance, employers have the right to view trip details if they subsidize a worker's fare card.

Share story

The ORCA network offers the convenience of using a single card to pay for rides on buses, trains, boats, streetcars and vans.

While those riders enjoy not having to dig for change, their movements are recorded electronically on buses and at rail stations. Governments use that information to help divide the fare income and study travel patterns among seven different transit agencies in four Puget Sound counties.

But what thousands of commuters might not realize is that their movements also could be checked by their bosses.

Whenever someone buys an employer-subsidized fare card through one of 2,000 companies or institutions, the employer has the right to see that person’s travel records. A boss could check to see, for example, whether someone is abusing a subsidy by reselling ORCA cards or find out if an employee called in sick but rode the bus to the mall or the beach.

And if you register any ORCA card, as transit officials suggest to protect against loss or theft, your personal information goes into the transit-agency database. Personal fare-card information is technically available to news media and other groups, as well, though it’s unclear how forthcoming ORCA would be in providing it.

Like other everyday technologies, the fare-card transition brings people to a fork in the road between privacy and efficiency.

ORCA — an acronym of One Regional Card for All — is a card that riders use like a debit card, tapping it against an electronic reader as they get on a bus, train or boat. The cards either have cash balances that are drawn down by the trip or are used as a flat-rate monthly pass. Card sales began in April, and ORCA is gradually replacing other transit passes over the coming year.

ORCA already is used for 100,000 trips a day and will pay for a growing share of the region’s half-million daily transit rides, replacing 300 kinds of passes and transfers. Cash payers are being pushed toward the ORCA card, because many paper transfers will no longer be honored after Jan. 1.

People can assure privacy by purchasing a nonsubsidized card and not registering it, but that would typically cost hundreds of dollars more out-of-pocket each year.

Transit managers have enacted certain safeguards, partly in response to scrutiny by the American Civil Liberties Union (ACLU) and by SocTech, a coalition of University of Washington researchers and students. But the option remains for employers to check data.

“I understand the concern people would have if every movement is tracked,” says Sound Transit CEO Joni Earl. “That’s not the purpose of ORCA.”

Odd language

Doreen McGrath, who works for Seattle City Light, was startled when she visited the ORCA sign-up page on the city intranet and found a disclaimer that said the date, time and location of card use would be recorded and accessible to the city.

“The city will not use ORCA data to monitor an individual employee’s performance on an ongoing basis … The city will not use information obtained from ORCA as the sole basis to discipline a city employee,” the note read.

“I find that an amazing violation of my right to privacy,” said McGrath. “I don’t need them to know my private movements. It’s none of their damn business.”

She initially refused to click the “I Agree” box, but later signed up by the Nov. 18 deadline, to keep the annual fare subsidy worth $972. McGrath sent an e-mail message saying she does not consent to the city grabbing her trip records and fired related messages to Mayor-elect Mike McGinn and a personnel manager.

ORCA furnishes to employers some standard language about data collection, to be shown to workers who sign up.

“The principle behind that is the business or educational institution owns the card,” said Candace Carlson, ORCA contract administrator. A company has legitimate interest in checking records to avoid misuse, for instance, if an employee resells a subsidized card, or if cards are stolen.

But that sentence about discipline came from the city of Seattle. The city’s intent isn’t to snoop, but in the interest of full disclosure, officials added the clause based on consultations with labor unions, said city spokeswoman Katherine Schubert-Knapp.

Originally, ORCA planned to give employers regular breakdowns of how, when and where each card was used, but dropped that idea in 2008.

Now, trip data will be released only if requested in writing by a company’s designated liaison to ORCA — leaving an electronic-paper trail. “I think you would think twice, if you have a malicious reason, for going on record with the agencies to request the record,” Carlson said.

ORCA is not collecting the employee names, just the serial numbers of batches of cards sold to the 2,000 companies. Such personal links, if any, would be made by an employer.

In addition, transit customers give personal information directly to the government when they register cards with ORCA or sign up for automatic monthly deposits to card balances.

Privacy lobby

Already, some local companies and other institutions are responding to potential user unease by creating policies about what data they will or won’t collect, and how they might use it.

Boeing, where about 1,200 people use transit or van pools in the Puget Sound region, considers its fare cards “a company-provided benefit, privacy-protected,” said spokeswoman Kathy Spicer.

Boeing will record names of participating employees only to reimburse them for buying ORCA cards — for instance, a $30 company subsidy on a $45 Snohomish County monthly pass. The company will not check individual card use, she said.

The University of Washington — home to perhaps 60,000 potential card users — is still negotiating a final agreement with ORCA, to make the changeover in the second half of 2010.

“We take privacy of that information very, very seriously and intend to only access travel information in aggregate form,” said UW transportation services director Josh Kavanagh.

Early on, the UW intended to mine fare-card data to deter misuse, but computer-science students urged the university to avoid seeking it, said Karl Koscher, a grad student who researches privacy issues.

The chips inside ORCA cards are designed to be read only within a few inches, so there is minimal worry about riders being surreptitiously monitored by a tech-savvy third party, said Koscher.

The larger risk is the “back-end database,” said Koscher, adding that “subsidized passes are one of the things we’re most concerned about.”

ORCA’s privacy statement says transit agencies will share information for a few reasons, including “to respond (voluntarily or involuntarily) to a subpoena, court order or other legal process and requests by a government agency … .” Smart cards are relatively new, but in some states, car-toll records have seeped out in lawsuits, such as divorce cases.

The ACLU will support efforts in the 2010 Legislature to further guard transit riders, said Doug Klunder, the group’s privacy-project director for Washington state. Such a bill would likely seek to ban news-media access to personal-trip data, and also shield it from employers, except in cases of fraud.

But Lee Tien, senior attorney at the Electronic Frontier Foundation in San Francisco, challenges the notion that transit agencies actually need the enormous amount of trip data ORCA generates or that any record should be kept more than 24 hours. San Francisco’s BART works just fine with a magnetic stripe card that doesn’t record locations, he said. “It doesn’t need to, and the system hasn’t fallen apart.”

Mike Lindblom: 206-515-5631 or