CSIRO's data science experts found that the detailed nature of the information in the dataset created a high risk that some individuals may be identified by linking the dataset with other information sources.
The myki id is not included but there is still a unique and consistent identifier for each Myki user. The data also contains the type of Myki card, for example, police or politician concession - some of these categories are quite small. All you need to do is identify the person from one journey then you have their whole travel history. So for a work colleague, you could observe them touch on in Melbourne and if you know which station they get off at you can find all their travel records. Researchers at the University of Melbourne identified a politician and his travel history based on his social media.
The Victorian Deputy Commissioner for Privacy and Data Protection found the release of this data by the Department of Premier and Cabinet was a serious breach of the Privacy and Data Protection Act 2014.
Thats better detail than the story. Yes there should be no common identifier