You can use them with cash but why would you go through all those hoops? Better fix the personal data creep and illegal surveillance at the source, I'd say, then we can all benefit from good travel system planning and all those wins which big data promised us - while mostly delivering more ads instead.
Cash payments aren't the easy win you think they are. The system has to know where the money was paid from and when, at which point you just go back to the CCTV.
Any system that relies on a UID is trackable, it just depends how much legwork you're prepared to put in.
China has proven that no one needs to "watch" CCTV, because the system will automatically identify everyone in the camera frame.
That still requires more resources than mobile app tracking, and it's easier for people to disguise themselves against a camera rather than mobile app tracking, so mobile app tracking is the greater current threat.
But CCTV identification will improve and it will be harder to fool, so I don't want that either.
As so many people here bash and misunderstand the GDPR, I can tell you why. I leave the surveillance out.
What I man by (probably) unlawful is not that they wouldn't have the right to collect that data due to public interests. And I am sure many locals wouldn't bother sharing their data with the city if it helps to improve its and hence theirs transport system (like it probably does). But you'd have to reverse engineer the app to see whether the data goes also to ad-tech and who knows who else. That's one thing.
And also a telecom has the data due to different obligations. But they also do business with it. That's the second thing. Also the smartphone manufacturer probably has it, and that's the third interesting thing.
But, now, under the GDPR, none of them "own" the data because it is your personal data. With this point, please also stop using the term PII. This covers anything and pretty much everything; like the author, I am interested in the geolocation data but I'm sure there's a lot more interesting stuff.
Then, under the GDPR---because it is your personal data and it "belongs" (for a lack of a better term) to you---you'd want to exercise the many rights granted to you by the laws, the GDPR and the Charter. Particularly, you'd want to exercise your rights to have your personal data and transfer it to another system in a portable manner. In fact, you want it real-time through a 24h API because it is your fundamental right.
Then, assuming you have your personal data from the city, from the telecom, and from the smartphone manufacturer, you can compete with them, do AI/ML with your personal data, do crowd-sourced science with others, do open data with open source, donate it to your favorite city in Europe or even the EU, or, hell, even sell your personal data if you want to.
What a hopeless ideal. You don't have any control over personal data when the law assigns ownership to you.
The law assigns personal ownership of your data, to control you.
The farcical idea that some law will allow the individual to reverse decades of progress towards electronic identity systems (even for themselves) is a joke.
It's over for the British, the culture won. You cannot oppose cultural movements anymore, because they happen behind a computer screen. Britian is dead.
You can't say no to electronics. The cat behind the curtain could be anybody. A state, a corporation, a theocracy, ect.
Xi Jin Ping (or a Jihadist) could hypothetically set all the electronic rules in the UK and nobody would know the difference.
When a cultural revolution happens behind the electronic curtain, your conscience can't know it, or oppose it.
Severing control of one's behaviour, from the individual conscience and placing it in the hands of electronics.
Brings into existence total cultural control of Britian, without the ability for individuals to oppose it or understand it.
Our world used to run on written agreements and Kantian-esque moral emotions with Duty. None of that matters or has any influence over an electronic life. All that matters is the will, so told by the unseen electronic controllers.
Britian is dead and Britian is not allowed to know it.
Given the ubiquity of cameras and how optimized face recognition has gotten over time, this is mostly pointless at this time. You will be tracked unless you really pull a major disguise every time you go out.
