Personal information from tens of thousands of Aucklanders was given to a private company by council authorities, with the details then used in a marketing blitz.
Auckland Transport gave information held on users of the "Hop card" - which are used to pay fares on buses - to a third party, Snapper Services, which embeds electronic chips in the cards so they can also be used to pay for items in affiliated shops.
Snapper then used the email addresses contained in the personal information to launch a campaign advertising its retail services.
Auckland Transport said it was concerned about the use of the information. But it would not indicate how much information it had passed to Snapper under the Hop system's privacy policy, which claims a right to collect details about the lifestyle of card-holders and how much they spend.
There are at least 93,000 Hop card users. Those who registered their cards on the website would have received marketing emails from Snapper.
Devonport-Takapuna Local Board member Joseph Bergin, a 19-year-old law student and Hop card user, said fellow passengers had registered concern with him about the email.
He has written to Auckland Transport chairman Mark Ford complaining of the "inappropriate use of personal information [that] the Hop card privacy policy allows Auckland to collect" and asking what other details have been passed to Snapper.
Auckland Transport spokeswoman Sharon Hunter blamed the apparent breach of privacy on the company.
"Essentially that was a mistake on the part of Snapper - that wasn't an appropriate use," she said. "We are aware of the issue and are currently investigating the details with Snapper."
But Mr Bergin wondered why Auckland Transport had provided personal information to Snapper in the first place under such a loose privacy policy.
Although only names and email addresses are required to register a Hop card, users are also invited to supply phone numbers and street addresses.
The policy also reserves the right to collect information about commercial transactions and birth dates.
It says there may be times when personal information is disclosed to Hop partners such as Snapper and NZ Bus, but only if they are likely to provide products or services "that may be of interest to you" and have contracted to keep the data confidential.
Mr Bergin said it was "very bizarre" that a public agency should have produced such a questionable policy.
"The question is whether Snapper is going to go away with a database containing details of 80,000-odd Auckland Transport users. If they were to know, for example, that I am a 19-year-old and catch a bus on a regular basis at a certain point, can NZ Bus use the information to target advertising towards me and claim added value to their advert buys?"
A spokeswoman for Privacy Commissioner Marie Shroff said her office would need to study the Hop policy before commenting.
But she provided a statement of concern it issued in 2008, soon after Snapper cards were introduced to Wellington, about the amount of information asked of registered users.
Although card holders could elect not to register them, they would be unable to seek credit refunds if they were lost or stolen. Snapper's management was unavailable for comment.
THE HOP CARD
* Used by at least 93,000 Aucklanders on the city's largest bus fleet, NZ Bus.
* A "top-up and spend" system which allows users to pay bus fares without using cash.
* Contains electronic chip supplied by Snapper Services, which allows it to pay for goods at affiliated shops.
* Due to be replaced this year with advanced card which can also be used on trains and ferries.