MBTA Announces Update to Customer Privacy Policy

Today the MBTA announced updates to its Customer Privacy Policy.

Including the collaboration and input of transportation and privacy advocates over the past several years, the updated Policy modernizes the MBTA’s approach to data privacy, prioritizing a renewed commitment to customer privacy and transparency in how the MBTA collects and uses customers’ personal data. This Policy applies to all MBTA services and describes what personal information may be collected, how and why such information is collected, and instances where the MBTA may share such information. This includes customer data that the MBTA collects online and through the use of transit and other services. This Policy also describes the choices riders may have regarding information that the MBTA collects, including how riders can manage, update, or make requests concerning their personal information. The MBTA is committed to continually reviewing the Policy as technology advances, and riders can share their questions about privacy and the Policy by emailing privacy@mbta.com.

This Policy is guided by five principles:

Privacy by Design: The MBTA ensures privacy is designed into the architecture of its services and business practices.
Collection and Purpose Limitation/Data Minimization: The MBTA strives only to collect customer data for the purposes of fulfilling its mission and improving service, and not to collect data that it does not need.
Data Retention and Protection: The MBTA seeks to ensure the data it collects is stored and shared according to law and information security best practices, and the MBTA only keeps customers’ personal data for as long as it needs to.
Restricted Data Sharing: The MBTA only shares customers’ personal data outside of the MBTA with its partners who help deliver transportation services, when required by law, or with a customer’s explicit consent. When the MBTA shares customer data, the MBTA seeks confirmation that its partners will follow agreed-upon security controls.
Transparency and Accountability: As a public agency, the MBTA is committed to being clear, open, and honest about what customer data it collects, how the MBTA uses it, and what riders’ rights are in relation to it. It is the MBTA’s responsibility to implement these principles with consistency.