I mean sure they could probably display less information when you punch in that card number. But the biggest sticking point for this is I don’t see how they could create a secure system without forcing you to create an account? Which personally I think would be ridiculous.
In the Netherlands, they solved this by adding a randomly generated transaction reference to the payment. This will appear on your bank / credit card statement. To view details for the transaction (time and location of entry/exit), you have to enter the paid amount and reference.
However, this will only give you info for a single transaction. If you want to see an overview of all your transactions, you need to create an account in their app. After linking your card to your account, again using the reference and amount for a transaction, you can view your travel history.
Every city had a fine system using cash/coins or cards you could fund at a kiosk by cash coin or card. Those cards were anonymous.
Now everyone has to be fancy and link credit cards and phones to accounts for every activity of daily life.
The card system would probably be best where just buy a card and load it up at a kiosk. There would still be potential security vulnerabilities if you were allow someone to "anonymously "view that transaction. Or allow someone to view the card trips. Which would just be logged with its number.
And I’m just more so talking about the current system they have in place. I’m not sure what else they could do utilizing their current system except for forcing some kind of account
It would be trivially easy to add privacy any number of ways if they didn’t insist on tracking the users and logging that info.
They could even track it and just not make it available by web. Or require 2FA. Not exactly a nation-state level attack being described here.
People have just become accustomed to not caring about privacy and so that’s what we get.