University College Dublin Students’ Union (UCDSU) has criticised the Student Leap Card system this evening over concerns of “serious data protection flaws”.
According to UCDSU President Barry Murphy, there is a possibility that the current system could be “abused to allow individuals inappropiately [sic] access students’ details”. As a result, UCDSU have decided to refrain from signing a data processing agreement to provide Leap Cards to students on the UCD campus in Belfield until the issue is addressed.
The system allows students to sign up for their Student Leap Card online and collect it at a later date. However, this process gives Leap Card staff the ability to access the student’s personal details, including the email address, phone number, date of birth, and home address of any applicant across the country.
It is believed that this flaw is a result of the six digit application code, which was introduced last year. When a Leap Card agent searches for the specific application, they are presented with numerous applications, which reduce as the full code is entered. This allowed Leap Card agents to view any application with a similar number to that which they were searching.
According to emails seen by the Irish Times in August, UCDSU and the National Transport Authority (NTA) classified the flaw as an issue of “category one importance”. However, UCDSU originally voiced their concerns on the issue in May, according to emails between UCDSU and Fimak, the firm which operates the Leap Card system.
A spokesman for the NTA said that it has “worked closely with UCDSU to address their concern and have made some changes to the way in which Student Leap Card data is stored and processed”.
Barry Murphy also added that “UCDSU did not want to risk having the personal information of our student members abused…As students across the country begin this semester, we need this serious data breach to be resolved immediately”.
According to the NTA spokesperson, changes are currently being trialled and are expected to be implemented in the coming days.
