Lia Timson and Adam Carey August 09, 2012
Myki top-up machines spit out customers' credit card details without their knowledge. Photo: Jessica Shapiro
The Acting Victorian Privacy Commissioner Anthony Bendall has written to the Victorian Transport Ticketing Authority to ask how it is going to fix a glitch that causes Myki vending machines to issue receipts that contain sensitive personal information.
Mr Bendall told Fairfax the authority is subject to the Victorian Privacy Act and as such must make sure customer private information is protected from unauthorised access and potential misuse.
"I've given them a couple of weeks and asked them [to respond] with either a meeting or a written briefing," Mr Bendall said.
The glitch is believed to have caused details such as credit cardholder's name, nine out of 15 digits of their credit card number and expiry date, to be printed on receipts.
Thousands of people are believed to unknowingly leave Myki receipts on or near the machines in busy locations at train stations, tram stops and bus interchanges.
It is against credit card company's rules and international payment standards for receipts to display more than the last four digits of the card number.
The Baillieu government said it would fix the glitch that issues a receipt when cardholders top up a Myki account using credit or eftpos, even if a person specifically declines to print one. Requests for a receipt result in two copies being printed.
Mr Bendall said he would wait for the authority's response before deciding what to do next. In the worst case scenario he said he could issue a compliance notification.
Minister for Public Transport Terry Mulder told media yesterday that the government would work with the Transport Ticketing Authority to fix the problem, which could take months.
The Age revealed yesterday that fears had emerged that the glitch could leave public transport users exposed to privacy breaches and identity fraud.
There have been no reported cases of fraud or identity theft from the glitch.