[Paper Review] Differentially Private Release of Public Transport Data: The Opal Use Case

Hassan Jameel Asghar, Paul Tyler+1 more|arXiv (Cornell University)|May 16, 2017

Privacy-Preserving Technologies in Data4 references3 citations

TL;DR

This paper presents a differentially private release of public transport data from Sydney's Opal smart card system, using a tailored algorithm to preserve privacy while maintaining utility. By applying a composition of private mechanisms with calibrated noise to marginal counts across transport modes and dates, the authors released a 14-day dataset with ε=8 and δ≈10⁻⁶, ensuring strong privacy guarantees while enabling meaningful analysis of transit usage patterns.

ABSTRACT

This document describes the application of a differentially private algorithm to release public transport usage data from Transport for New South Wales (TfNSW), Australia. The data consists of two separate weeks of "tap-on/tap-off" data of individuals who used any of the four different modes of public transport from TfNSW: buses, light rail, train and ferries. These taps are recorded through the smart ticketing system, known as Opal, available in the state of New South Wales, Australia.

Motivation & Objective

• To enable public release of sensitive public transport usage data from the Opal smart card system without compromising individual privacy.
• To address the challenge of releasing high-dimensional, real-world transit data while preserving utility for researchers and policymakers.
• To demonstrate a practical deployment of differential privacy in a real-world public sector data release, particularly for mobility data.
• To balance privacy (ε, δ) with data utility by strategically allocating privacy budgets across different data partitions.
• To provide a reusable, open dataset that supports transportation research while preventing re-identification through formal privacy guarantees.

Proposed method

• Applied differential privacy using the Sparse Vector Technique (SVT) and the Report-noisy-max (RNM) algorithm to answer marginal count queries on the Opal dataset.
• Partitioned the dataset into 56 disjoint subsets based on transport mode and date to enable parallel composition and improve utility.
• Used sequential composition to manage privacy budget across 6 query types: 4 one-way marginals and 2 two-way marginals, with ε=1 for one-way and ε=2 for two-way queries.
• Set δ_j = 1/8,000,000 ≈ 2⁻²³ per partition to ensure a small overall δ < 10⁻⁶ after composition, minimizing failure probability.
• Removed all personally identifying information (e.g., individual IDs) before applying noise, ensuring that only anonymized, aggregated data was released.
• Employed the SBH algorithm to ensure differential privacy with bounded error probability, and proved end-to-end privacy via composition theorems.

Experimental results

Research questions

• RQ1 How can high-dimensional public transport data be released in a way that preserves individual privacy while maintaining analytical utility?
• RQ2 What is the optimal allocation of privacy budget (ε) across different types of queries (one-way vs. two-way marginals) to balance privacy and data utility?
• RQ3 Can differential privacy be practically applied to real-world, large-scale public transit datasets without compromising usability?
• RQ4 What are the implications of using a non-zero δ in practice, and how can it be calibrated to ensure strong privacy guarantees?
• RQ5 To what extent does removing identifying attributes before noise injection enhance privacy in the context of differential privacy?

Key findings

• The final dataset was released with a total privacy budget of ε=8 and δ<10⁻⁶, achieved through sequential composition of 8 noisy queries.
• The two-way marginal queries were allocated a higher privacy budget (ε=2) than one-way queries (ε=1), which improved the number of non-zero counts in the output and enhanced data utility.
• The use of δ≈2⁻²³ per partition ensured that the overall failure probability was less than 10⁻⁶, making the privacy guarantee robust in practice.
• The dataset was successfully released as open data, with no identifiable information retained, and no anomalous or synthetic rows that could mislead users.
• The approach demonstrated that differential privacy can be effectively applied to real-world, high-dimensional mobility data with meaningful utility for public research and policy.
• The project established a precedent for privacy-preserving data sharing in public transport systems, showing that formal privacy guarantees are feasible in practice.