Personalised rail passenger experience and privacy

In this article the authors discuss the implications of this data collection in terms of its potential benefits to the customer experience, its impact on passenger privacy, the information security risks to the industry from storing all this personal data as well as the need for data provenance and how anonymisation of data will impact its provenance and utility.It is imperative for the industry to look at the trade-offs between the need to store personal data to provide an improved customer service and the legal ramifications of doing so, especially in the light of the incoming General Data Protection Regulation (GDPR) [1] (to be enacted in UK law by May 2018) which makes organisations liable for a substantial fine in the case of a serious data security breach.To help operators address these data protection and legal compliance issues, the authors provide a brief overview of existing privacy and security frameworks, standards and guidelines which can assist the industry in utilising a best practice and well-established approach