And of course you would only need a sample of passengers with static MACs for this to work.
As for spoofed on phones, maybe if you have root. But i doubt it comes spoofed out of the box (at least i have never heard of such a thing).
This all sounds pretty good to me. Short-term tracking like this is useful and not very invasive. The randomization will still defeat long-term invasive tracking, like a store recognizing you from past visits and building up a database of your individual activity from that.
Isn't that quite contradictionary?
Yep. It sure is. Know how spammers that don't run afoul of the CAN-SPAM act get really salty when you call their spam spam? The is the same sort of wordsmithing. By arguing that this identifiable information doesn't fall into the the "personal" bucket, they want the public to think what they're doing is A-OK.
They use weasel language to suggest following a standard of what "personal" data is means everything on the "not-personal" side is perfectly normal operation the consumer doesn't have to worry about. All while trying to derive as much personal information as possible from the not-technically-personal data.
> When a device passes the sensors, its non-personal unique ID, called a MAC address, is recorded, encrypted and time-stamped. By re-identifying the device from multiple sensors, travel times, average speeds, dwell times and movement patterns become available.
Aren't MAC addresses spoofed on most phones now?! I didn't expect a system like that to still be usable.