Data from a large number of students may be accessible by UCD agents without their consent, after the implementation of a new online application system for Leap cards.
The transport card, which allows students to travel at a discounted price, can now be applied for online and collected from a centre in students’ college. When a student applies for a card online, they must then bring a six-digit code to their local agent to verify the purchase and print the card. Many providers of Leap cards are located within students’ unions.
However, a flaw in the system means that when an agent types in the first numbers of the code, details for students with similar codes from across the country appear. Details available include names, addresses, photographs, mobile numbers, email addresses and dates of birth.
Introduced last year, the system has been criticised by University College Dublin Students’ Union (UCDSU) since May. In emails seen by the Irish Times, the union pointed out the “data protection flaw” to the holders of the system, Fimtak.
Speaking to the Irish Times, UCDSU President Barry Murphy said that the union “did not want to risk having the personal information of our student members abused . . . As students across the country begin this semester, we need this serious data breach to be resolved immediately”. The union has said it won’t sign any data processing agreement until their concerns are remedied.
Fimtak, the company that looks after the system on behalf of the National Transport Authority, responded to UCDSU by confirming that the authority had approved the system and it “is fit for this purpose”. While Fimtak said that the system is constantly reviewed, it also said that there was no plans to make any changes.
Further emails from the National Transport Authority to UCDSU, however, showed that the national authority shared the union’s concerns about the safety of the data. An official from the authority labelled it an issue of “category one importance”.
Speaking to the Irish Times, a spokesman for the National Transport Authority said that it had “worked closely with UCDSU to address their concern and have made some changes to the way in which Student Leap data is stored and processed”. With these changes still at the testing stage, it will only be in the coming days that any changes are implemented.
Available for use on Luas, Dublin Bus, Irish Rail and DART services, the cards are a popular means of paying for transport for students. As well as offering discounts for various shops and restaurants, the cards can also be used to get discounts on travel nationwide.
