What is the Anonymised Data Collection Trial?

How does it work?

How long do we keep the data?

How do we protect the data?

Who are we sharing the data with?

Data Collection and Data Protection


What is the Anonymised Data Collection Trial?

The Data Collection trial in collaboration with Flowly* is aimed at improving the Luas service for customers both now and in the future.


From December 2020 Wi-Fi sensors installed on 10 trams will be detecting passive signals of electronic devices to help Transdev, the Luas operator better understand how Luas customers move through the Luas network.


When an electronic device has Wi-Fi enabled, it will passively emit signals (probe requests) which contains an identifying number specific to that device known as a Media Access Control (MAC) address. When this signal is detected by a Wi-Fi sensor on the tram a log data is also collected.


Analysis of real-time passenger numbers and travel directions will allow us to improve the Luas service and meet the growing needs of the Luas customers.


For more information please click here.

Alternatively, visit Flowly (third party solution provider) at: https://luas.flowly.re/


We want to understand how Luas customers as a whole use the service, not how specific individuals use it.


Improvements you should see include:

  1. More frequent timetable changes and / or frequency changes
  2. Responding in real time to match customer numbers travelling
  3. Communicate this info in real time to you to allow you to plan your journey

This solution allows us to approximate and analyse customer journey times across the entire network. It can also view the connection times between Lines which will be beneficial to Luas customers who use the Red and Green Lines.


This solution is presently in use in the following networks helping Transdev and others to adapt and regulate the level of public transport services in the French cities of: Grenoble, La Havre, Roanne, Reunion, Toulon, Nimes, Avignon, Vitrolles, Rouen, Montpellier, Nice, Arles and Manoque.


In order to actively participate in and contribute to the success of this trial, we invite you to leave the Wi-Fi function of your device(s) enabled.


If you do not wish to participate in this trial, you can object to collection of your data through dedicated third party (Flowly) website at: https://luas.flowly.re/


*Flowly is a patented solution co-developed by Transdev which counts passengers on board public transport.


Whilst the Flowly solution was originally designed to assist operators with managing passenger flows (numbers) and to design their offer to suit customers’ needs, it now can assist with physical distancing by using it to gain insights into numbers travelling on board trams in real time.


How does it work?

Wi-Fi sensors installed on trams detect passive signals (probe requests) from electronic devices.

The raw data of probe request includes:

Collected data is not used to identify specific individuals.

We are not collecting data such as your name, browsing history or phone numbers.


Wi-Fi sensor filters out devices other than mobile phones and pseudonymises data in near real-time. As result we will not be able to identify any individuals from the data collected.

The data is further filtered to remove non-tram users and then anonymised.


Pseudonymisation is the process of distinguishing individuals in a dataset by using a unique identifier that does not reveal their 'real world' identity. The goal of anonymisation is to remove any link with the user. This is a way of protecting people's privacy in accordance with the Data Protection Commission’s: Guidance on Anonymisation and Pseudonymisation (June 2019).


The statistical (aggregated) information is then made available to Transdev Dublin Light Rail Limited as the Luas operator on a dedicated platform.


For more information please go to 'How do we protect the data?' below.


How long do we keep the data?

Transdev Dublin Light Rail Ltd. will retain any data collected in line with our data protection policies. This means that we will not hold information for longer than is necessary for the purposes we obtained it for. Depersonalised Wi-Fi Data will be held for 24 hours. When this retention period is over, only aggregated data will be held.


For more information please go to 'Data Collection and Data Protection' below.


How do we protect the data?

We take the privacy of our customers very seriously.

A range of technical and organisational measures are in place to control and safeguard access to, and use of, Wi-Fi Data.


Each MAC address is automatically depersonalised (pseudonymised) and encrypted to prevent the identification of the original MAC address and associated device within the first 3 minutes.

The MAC address is then anonymised (using RSA-OAEP technique) within 3 hours from detection on the Wi-Fi sensor.


The database is stored on a secure dedicated infrastructure within an OVH tier three data centre in Paris, France. Collected data is stored in a restricted area of a secure location with physical access to the data centre governed through industry standard authentication methods.

Access is limited to a restricted group of users – i.e. only those whose access to the data is necessary for their role.


For more information please see: https://www.ovhcloud.com/en-ie/about-us/infrastructure-software/


Who are we sharing the data with?

Wi-Fi Data is collected by Flowly SAS Saint-Paul, France - the service provider (Data Processor).

Data is then stored with OVH in Paris, France (Data Sub-Processor).

Processed and aggregated data will be shared by Flowly with Transdev Dublin Light Rail Ltd. (Data Controller) and Transport Infrastructure Ireland (government agency).


Data Collection and Data Protection

We take the privacy of our customers very seriously.

We have chosen a Flowly patented solution that is privacy friendly, and that guarantees the anonymity and protection of users' personal data.

To ensure our approach to the collection of data is appropriate, we completed data protection impact assessments before we began collecting the data.


As part of this trail we are collecting and retaining the following personal data for the below purposes:




Retention period

Mobile Access Control (MAC) address

Flowly Wi-Fi Data Collection trial

3 hours

Log Data

Flowly Wi-Fi Data Collection trial

24 hours

Opposed MAC address

To allow exercise of Art. 21 GDPR rights

For the duration of the trial


To allow exercise of Art. 15 - 22 GDPR rights through dedicated Flowly website

Session duration

IP address

To allow Opposed MAC address execution

3 months

Data relating to customer queries and opposition requests received via email

To allow exercise of Art. 15 - 22 GDPR rights through dedicated Flowly email.

12 months


Data Subjects are not subject to automated processing as defined in GDPR.


The legal basis for this processing is legitimate interest of the controller, which consists of testing a device for measuring the flow of passengers by developing aggregated and anonymous statistics to optimize public transport services.


Under certain circumstances, by law you have the right to:

* Prior to anonymisation of the data - up to 3 hours after collection of MAC address; however, post data anonymisation the data and associated GDPR rights are no longer available.


If you do not wish to participate in this trial, you can object to collection of your data through the dedicated third party (Flowly) website at: https://luas.flowly.re/


You will not have to pay a fee to access your personal information (or to exercise any of the other rights); however, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.


We may need to request specific information from you to help us confirm your identity and ensure your right to access the personal information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request in order to speed up our response.


We try to respond to all legitimate requests within one month of receiving them. Occasionally, it may take us longer than a month if your request is particularly complex or if you have made a number of requests. In this case, we will notify you and keep you updated about our timing for response.


Transfer of data: All data will remain within the European Union.


The Data Protection Officer considers and coordinates responses to any requests that relate to an individual's rights under the GDPR and complaints from people whose personal data is processed as part of this trail. You can contact the Data Protection Officer by post to: Transdev Dublin Light Rail Limited, Luas Depot, Red Cow Roundabout, Clondalkin, Dublin 22, D22 C5P3 or email: info@luas.ie


If you have any issues about our handling of your personal information or about our data protection compliance, you have the right to make a complaint at any time to the Data Protection Commission (DPC), which is the Irish supervisory authority for data protection legislation (including under the GDPR).

Cookie Settings