According to the article,
The transit agency has received 26 requests from police forces so far this year and granted 12 of them, according to Metrolinx, which is the provincial transit agency that operates the Presto fare card system used across the GTHA and in Ottawa. It is not known how many requests Metrolinx granted in previous years because the agency only began tracking them in 2016.
This is one of the biggest risks of moving to an all digital payment system that is controlled by one entity. In many cases customers are actively discouraged from using privacy-safe alternatives like cash or tokens.
To bring this back to open source and professionalism. If the transit card systems were open source they could be audited. If the administration software was open source it could be audited and improved to add police data requests as part of the database. Whoever built the system to gather customer data should have been professional and raised the privacy concerns that affect customers.