A more informative article was posted earlier last month (https://www.ianvisits.co.uk/blog/2017/09/08/tracking-smartph...), and there was more info on the data privacy elsewhere too (https://www.theregister.co.uk/2017/09/09/london_tube_trackin...) saying that TfL "depersonalized [MAC addresses] using a salt which [they] then discarded at the end of each day."