Public transport companies are breaking privacy laws by storing information about students’ movements for too long, the national privacy watchdog CBP said on Thursday.

According to the law, public transport firms are not supposed to keep the information gleaned from ov-chipkaart smart cards for longer than ‘necessary to achieve the target’ – but those targets are often vague and poorly argued, the CPB says.
Amsterdam’s GVB public transport company, for example, stores details for 18 months but this can be up to 36 months in case of legal action for fraud.
Rotterdam’s RET takes 24 months as its limit for ‘service-related’ issues but up to 60 months for fraud prosecution.
The CBP says ‘steps must be taken to prevent unnecessary data processing and abuse’. The organisation first warned about the risk of information being illegally stored in 2005, before the card was introduced.