For a while now, I have been expressing my concerns over increased efforts to regulate 'precise geolocation information'. There are at least two bills before Congress that attempt to regulate the collection, use and transfer of 'precise geolocation information', not further defined. (Rep Rush's "Best Practices" Act and Rep Speier's "Do Not Track Me Online" Act.) Both bills state that precise geolocation information and "any information about the individual's activities and relationships associated with such geolocation" is sensitive information about an individual, and thus subject to enhanced protection. Other types of sensitive information include financial records and accounts, sexual orientation, religious beliefs, race and medical records.
In addition, the Federal Trade Commission issued a report in December that stated that 'precise geolocation information' was sensitive information, presumably subject to greater protection. Again, the phrase was not further defined. In fact, the term 'precise geolocation information' is quickly becoming a term of art within the burgeoning privacy community.
But, what does the term 'precise geolocation information' actually mean? Is one meter precision a greater threat to personal privacy than two meters? Moreover, depending upon the data type, there are various ways in which precision can be measured. - some of which have little to do with personal privacy. Alternatively, is the term precise intended to capture a 'temporal-spatial' component or simply a spatial one?
Just as important, who ultimately decides how the term applies in a consumer privacy context. The Federal Trade Commission (or perhaps the Department of Commerce) would likely include a definition in regulations they promulgate, if consumer privacy legislation is passed as currently drafted. However, invariably judges will be asked to interpret these regulations - and as a recent California court case shows, their decisions may be unsettling.
In Pineda v. Williams-Sonoma Stores, Inc., the court found that found that a person's zip code was "personal identification information" under California law. ('Personal identification information' and 'personally identifiable information' are also terms of art within the privacy community.) Personal identification information is defined in the relevant California statute as "information concerning [the individual] . . . including but not limited to, [the individual's] address and telephone number. The court found that (i) since an address included a zip code and (ii) a zip code can be useful in finding an individual's actual address, that a zip code was personal identification information subject to the applicable law.
This decision comes as a surprise to a number of retailers in California and will require them to change a number of long-standing business practices. (In an earlier decision a lower court had ruled that a zip code was not personal identification information). I am confident that over time lawyers in California also will try to extend this broadened definition of personal identification information to other areas of personal privacy - further impacting business operations.
A similar broad interpretation of 'precise geolocation information' could have a devastating impact on certain segments of the geospatial community. For example, the Rush and Speier bills both require a consumer's consent before collecting 'precise geolocation information'. Clearly, it would be impossible for an aerial or commercial satellite company to obtain such consent. However, one can imagine a court broadly interpreting precise geolocation information of an individual to include a high resolution image of an individual - or their children - in their yard by their house.
Moreover, using the logic of the Pineda decision, there is a very real possibility that a court could decide based upon the current wording of the Rush and Speier bills, that a zip code, or other broad geographic designation or description, is precise geolocation information subject to enhanced collection, notice and use requirements. This would have serious repercussions for a broad range of companies that collect, use or process spatial data.
It is unclear whether how much support there is on Capitol Hill at this time for consumer internet privacy legislation. However, it is fair to assume that the support for such legislation will likely increase, particularly given the increased attention by all segments of the media on this issue. Therefore, it is important for geospatial companies to keep track of these initiatives as they move forward to understand the potential impact on their current or future business operations.
No comments:
Post a Comment