Allow Location Permission? Return Privacy Policies

A. Introduction

Recent advances in wireless location tracking technology, including those present in mobile phones and radio frequency identification (RFID) chips, among other things, have led to an unprecedented potential for tracking people’s activities.

While this technology can enable location-based services (LBS) that adjust their functionality based on the user’s current location, the adoption of these services may be severely impeded by concerns over privacy.

There are three categories under which LBSs fall: position awareness, sporadic inquiries, and location monitoring.

• Devices that track a person’s location, such as GPS-enabled PDAs or in-car navigation systems, are considered position awareness if they only use the data internally.
• Sporadic inquiries are services that involve a person initiating the transfer of position information to an external service provider. These inquiries typically only include the user’s current location, as in point-of-interest inquiries to find, for example, the nearest hotel.
• Finally, location-tracking services frequently update their knowledge of a person’s location. For instance, experimental automotive telematics applications that aim to improve transportation through the use of information technology use these updates to estimate highway congestion and reroute drivers around traffic jams.

B. Location Tracking and Privacy Policies

I. THE EUROPEAN UNION

• The General Data Regulation Protection (GDPR) of the European Union (EU), renowned for its comprehensiveness and stringency, aims to safeguard information collected about EU individuals by applications and websites. Notably, this regulation applies to any organization that collects data from EU individuals, regardless of their location.
• The GDPR defines “personal information” broadly, encompassing a wide range of potentially collectible data types such as names, email addresses, SSNs, and geographical information. This definition serves a crucial purpose in protecting the privacy of EU individuals.
• Applications are required to have a Privacy Policy that is “concise, visible, comprehensible, and easily available” under the GDPR. The Privacy Policy must provide users with a clear understanding of how, why, and when their data is collected, among other things.
• Additionally, the EU Cookie Directive is another significant EU regulation that should be considered. All cookies used to track a person’s usage and geographic location are subject to this particular regulation.

II. THE UNITED STATES OF AMERICA

Numerous state-specific data protection legislations provide various levels of protection. However, there are certain user location indicators that should be taken into account, including:

• The California Online Privacy Protection Act (CalOPPA) requires companies or applications that collect personal data from California citizens to post a privacy statement while collecting personal information.
• The California Consumer Privacy Act (CCPA), which took effect on January 1, 2020, provides the highest data privacy regulations in the world. The California legislation expands on CalOPPA by giving customers greater rights to understand and refuse the sale of information collected about them by websites and applications. If CCPA applies to an organization, it should develop a privacy policy that aligns with its requirements.
• The Children’s Online Privacy Protection Act (COPPA) mandates that mobile applications and websites that collect data from children under the age of 13 must obtain parental permission, have clear privacy policies, and safeguard the collected data of children.

The Federal Trade Commission (FTC) is the federal regulatory body responsible for protecting consumers from unfair business practices, including the collection and storage of personal data, such as location tracking analytics.

III. GLOBAL PERSPECTIVE

If an application utilizes location data, it must adhere to additional data protection regulations beyond those in the U.S. and EU.

The Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada is applicable only to private businesses that gather or store user privacy data for commercial purposes. According to PIPEDA, users must provide consent for the collection of any user location data, and the data collected must be “appropriate.”

The Privacy Act of 1988 and its 13 Privacy Principles (APPs) regulate privacy protection in Australia. Geographical information is likely to be covered by Australia’s comprehensive definition of personal information, which encompasses any information or belief about an “identified individual.”

C. Additional Considerations for Location Data

• Sensitivity of Personal Location Data: Location data is considered a sensitive and unique category of data that is subject to stricter safeguards in most jurisdictions. Precise location data is legally sensitive and requires explicit consent from consumers before it is released. Legislative plans in the US, such as the California Privacy Rights Act and the proposed Consumer Online Privacy Rights Act, require affirmative express consent for the use of location data. The U.S. Supreme Court has also ruled that location data is sensitive and requires a warrant for law enforcement to access it. In the EU, access to location data is typically governed by the ePrivacy Directive, which requires individual agreement in most cases.
• Encryption of Precise Location Data is Difficult: Location-specific data is difficult to fully anonymize, making it challenging to protect the privacy of individuals. Governmental organizations seek “anonymous” or “anonymous and aggregated” location data for population-level trend tracking. However, it is still difficult to “anonymize” datasets with unique exact location data, even if names are replaced with unique identifiers. Politicians should exercise caution when making promises and treat location records as sensitive, private data subject to administrative, technological, and legal controls. It is essential to set restrictions on who can access location data and how to ensure its continued protection.
• Issues with Location Data-Sets: The unintentional disclosure of sensitive location data, even in aggregate form, can raise ethical concerns about open data and public data sharing. A prime example of this was the 2017 “World Heat Map” created by the exercise app Strava, which revealed the deployment locations of military personnel at top-secret sites. This highlights the need for businesses to consider all risks, including threats to privacy and group privacy, before sharing location data. Disadvantaged and underprivileged groups are especially vulnerable to unfair data processing practices, and thus require increased privacy safeguards. However, the representativeness and potential bias of location datasets must also be considered, as voluntary applications may be more popular among wealthy societies. The example of the “Street Bump” app created by a local authority shows that relying on voluntary participation may result in disproportionately unfair distribution of resources. Mobile phone carrier statistics could be more representative, but may exclude certain demographics who do not own smartphones.
• Importance of Purpose Limitation: During a crisis, it is crucial to limit the purpose of collecting location data. The Fair Information Practice Principles (FIPPs) and the General Data Protection Regulation (GDPR) emphasize the importance of purpose limitation. However, there is a concern that location data collected for pandemic tracking may be stored or utilized for other reasons because it is sensitive and difficult to de-identify. If the data is repurposed for pandemic tracking, it should be siloed and not used for other purposes. The government should consider how the data was initially collected and implement clear rules and procedures for data management for researchers and government organizations.

D. Conclusion

The use of location data raises numerous privacy concerns that should be taken into account by policymakers, businesses, and individuals alike. The potential benefits of using this data for public health, urban planning, and other purposes must be balanced with the risks of data breaches, identity theft, and other privacy violations. Therefore, any use of location data should be subject to strict controls and oversight, including data minimization, purpose limitation, and anonymization techniques that are effective in protecting individual privacy. It is essential that the collection, storage, and processing of location data be carried out in a transparent, responsible, and ethical manner, with appropriate safeguards in place to prevent abuses and protect individuals’ rights. As technology continues to advance and new applications of location data emerge, policymakers and society as a whole must remain vigilant in protecting individual privacy and ensuring that the benefits of these technologies are distributed equitably across all segments of the population. Take the first step towards a secure your organization’s data by scheduling a call with our privacy expert team at Tsaaro Solutions today.