Surely you know what personal data they have?
For me, they will have my name, address, credit card and expiry date (not the 3 numbers on back), log in username and password, a record of tickets I have bought both ticket and smartcard, my smartcard number and email address. My account will have...