Sunday, February 20, 2011

Will A Zip Code Become 'Precise Geolocation Information'?

For a while now, I have been expressing my concerns over increased efforts to regulate 'precise geolocation information'. There are at least two bills before Congress that attempt to regulate the collection, use and transfer of 'precise geolocation information', not further defined. (Rep Rush's "Best Practices" Act and Rep Speier's "Do Not Track Me Online" Act.) Both bills state that precise geolocation information and "any information about the individual's activities and relationships associated with such geolocation" is sensitive information about an individual, and thus subject to enhanced protection. Other types of sensitive information include financial records and accounts, sexual orientation, religious beliefs, race and medical records.

In addition, the Federal Trade Commission issued a report in December that stated that 'precise geolocation information' was sensitive information, presumably subject to greater protection. Again, the phrase was not further defined. In fact, the term 'precise geolocation information' is quickly becoming a term of art within the burgeoning privacy community.

But, what does the term 'precise geolocation information' actually mean? Is one meter precision a greater threat to personal privacy than two meters? Moreover, depending upon the data type, there are various ways in which precision can be measured. - some of which have little to do with personal privacy. Alternatively, is the term precise intended to capture a 'temporal-spatial' component or simply a spatial one?

Just as important, who ultimately decides how the term applies in a consumer privacy context. The Federal Trade Commission (or perhaps the Department of Commerce) would likely include a definition in regulations they promulgate, if consumer privacy legislation is passed as currently drafted. However, invariably judges will be asked to interpret these regulations - and as a recent California court case shows, their decisions may be unsettling.

In Pineda v. Williams-Sonoma Stores, Inc., the court found that found that a person's zip code was "personal identification information" under California law. ('Personal identification information' and 'personally identifiable information' are also terms of art within the privacy community.) Personal identification information is defined in the relevant California statute as "information concerning [the individual] . . . including but not limited to, [the individual's] address and telephone number. The court found that (i) since an address included a zip code and (ii) a zip code can be useful in finding an individual's actual address, that a zip code was personal identification information subject to the applicable law.

This decision comes as a surprise to a number of retailers in California and will require them to change a number of long-standing business practices. (In an earlier decision a lower court had ruled that a zip code was not personal identification information). I am confident that over time lawyers in California also will try to extend this broadened definition of personal identification information to other areas of personal privacy - further impacting business operations.

A similar broad interpretation of 'precise geolocation information' could have a devastating impact on certain segments of the geospatial community. For example, the Rush and Speier bills both require a consumer's consent before collecting 'precise geolocation information'. Clearly, it would be impossible for an aerial or commercial satellite company to obtain such consent. However, one can imagine a court broadly interpreting precise geolocation information of an individual to include a high resolution image of an individual - or their children - in their yard by their house.

Moreover, using the logic of the Pineda decision, there is a very real possibility that a court could decide based upon the current wording of the Rush and Speier bills, that a zip code, or other broad geographic designation or description, is precise geolocation information subject to enhanced collection, notice and use requirements. This would have serious repercussions for a broad range of companies that collect, use or process spatial data.

It is unclear whether how much support there is on Capitol Hill at this time for consumer internet privacy legislation. However, it is fair to assume that the support for such legislation will likely increase, particularly given the increased attention by all segments of the media on this issue. Therefore, it is important for geospatial companies to keep track of these initiatives as they move forward to understand the potential impact on their current or future business operations.

Saturday, February 12, 2011

Centre for Spatial Law and Policy Comments to FTC on Privacy and 'Precise Geolocation Information'

Below is the text of the letter that the Centre for Spatial Law and Policy sent to the Federal Trade Commission regarding its report, "Protecting Consumer Privacy In An Era of Rapid Change".

February 8, 2011

The Honorable Jonathan D. “Jon” Leibowitz, Chairman
Federal Trade Commission
600 Pennsylvania Avenue, NW
Washington, D.C. 20580

RE: Public Comments on December 1, 2010 Preliminary FTC Staff Privacy Report

Dear Chairman. Leibowitz:
The mission of the Centre for Spatial Law and Policy (http://www.spatiallaw.com/) is to improve the understanding of the unique legal and policy issues associated with the collection, use and distribution of location and other types of spatial data. Such an understanding is a necessary component in the development of a consistent and transparent legal and policy framework that will allow for the successful growth of the emerging U.S. spatial technology industry while still protecting important and legitimate privacy and societal interests.

Our comments below are therefore focused exclusively on this aspect of the recent Federal Trade Commission (FTC) report, Protecting Consumer Privacy in an Era of Rapid Change (the “Report”). The Report provides on page 61 that:

“[t]he Commission staff has supported affirmative express consent where companies collect sensitive information for online behavioral advertising and continues to believe that certain types of sensitive information warrant special protection, such as information about children, financial and medical information, and precise geolocation data [emphasis added].. Thus, before any of this data is collected, used, or shared, staff believes that companies should seek affirmative express consent. Staff requests input on the scope of sensitive information and users and the most effective means of achieving affirmative consent in these contexts”.

We appreciate this opportunity to comment on the Report. Clearly, location information is becoming an increasingly important component of our daily lives, as location-aware smart phones and other devices are collecting enormous amounts of data. The level of available detail--and potential privacy risks--will only increase with time, compounding existing concerns about privacy.

However, it is important to recognize the growth and increased importance of the geospatial industry in the U.S. In fact, the Department of Labor identified geospatial technology as one of the top three growth industries in the 21st century. In addition, there are as many different types of geolocation data as there are ways to collect and use the data. The Department of Interior, when announcing the formation of the National Geospatial Advisory Committee, a Federal Advisory Committee formed in 2007 to advise the Secretary of Commerce on geospatial matters, refers to geospatial information as “information integrated from multiple forms of data about precise locations on the Earth’s surface.” [emphasis added.] Similarly, a recent Congressional Research Service report, entitled “Geospatial Information and Geographic Information Systems”, describes the many different types of geospatial information and the ways the information can be acquired and utilized.

As a result, the Centre and its members do not agree with a general assertion that location information should be treated the same as medical records or financial records.

We acknowledge that the FTC conducted a series of meetings on internet privacy prior to the report. However, we do not believe that enough attention was paid to location, particularly the issues described below. This is due in part to the rapid changes in the adoption of geospatial technology over the past eighteen month. It also because the language currently being proposed with regards to location could impact businesses that would not have considered themselves stakeholders at the time of the meetings. As a result, we request that the FTC conduct further discussions with the geospatial industry – broadly defined - before any government mandates are imposed regarding location data. Without such a discussion, overly broad or poorly defined legislation and/or regulation could stymie the numerous important governmental, economic and societal applications currently being developed based upon location.

1. Location information is often public. Unlike the other types of sensitive information described in the report, a person discloses his or her location to strangers every time he or she goes out into the public. Therefore it is unreasonable to expect that with regards to collection, this information should receive, as some have proposed, greater protection than an individual’s credit card number or driver’s license number and the same protection as medical history or sexual orientation. The Supreme Court in a number of cases related to Fourth Amendment privacy issues has found that citizens do not have a reasonable expectation of privacy while in public places. Any proposal to regulate location information must be mindful of the potential impact such regulations might have on other such important policy considerations.

2. Location information is vital. Unlike the other types of “sensitive information”, location data is being used to provide a number of critical governmental, societal and business services that are empowering citizens in ways that were unimaginable just a decade ago. The number and value of these services are increasing on an almost daily basis. We believe that attempting to regulate the collection of location data could have a number of unintended consequences, including limiting the number of such services, both now and in the future. We recommend that such opportunity costs be fully explored and understood before regulations are imposed.

3. Consistency is critical. As the Commission knows, a number of privacy-related initiatives are currently underway in Washington that attempt to address potential privacy issues associated with geolocation data. These include the Commission’s Report, the Department of Commerce’s Green Paper, and various Congressional legislative efforts. Each cites “precise geolocation information” as sensitive data warranting greater protection.

4. Some concerns should be addressed elsewhere. Certain concerns about protecting consumer’s location privacy, such as those associated with the use of location technology for so-called “cyberstalking”, can and should be better addressed in other ways, for example, through criminal penalties. As recent court decisions involving the Electronic Communications Privacy Act (ECPA) have shown, trying to fit location information into the same privacy construct as other types of information is extremely complicated, and still might not achieve the desired results.

We believe that before any regulations are proposed, the term “precise geolocation information” must not only be generally understood, but also carefully and consistently defined. Otherwise there is a great of risk of confusion and uncertainty, which would not benefit any stakeholder

We look forward to working with you as these discussions move forward. To that end, we would like to request a meeting with your professional staff who handles this issue. I may be reached at 804.928.5870 or Kevin@spatiallaw.com. I look forward to continuing our discussion and thank you for your time and attention.

Sincerely yours,

/s/ Kevin D. Pomfret

Kevin D. Pomfret
Executive Director

Tuesday, February 8, 2011

Geolocation Check-Ins:A Teenager's Perspective

Many people have expressed concerns over consumer privacy associated with location-based social networking services such as Foursquare, Facebook Places and Latitude. Such concerns are increased with respect to teenagers' use of these services. In order to understand both a teenager's use of such services and the potential privacy implications associated with such use, I have asked my 17 year-old son to begin using some of these services and to periodically update his experiences on this blog. The following is his first installment:

After exploring the many different location based applications such as SCVNGR, Foursquare, Facebook Places, and Latitude, my initial reaction is that these applications are probably not for a teenager like me. They have a lot of different, useful features, but they do not relate, and are not useful, to me. This is mostly because my friends and I rarely go to different restaurants and places, except for fast food and one local sports bar. These applications seem to me to be designed for adults that go to a bunch of different places and try all kinds of new things. For a teenager like me, I am not sure that these apps these apps have any use. For us, it is usually easier to just text or call a friend to let them know where we are going, or invite them to come hang out with us. Also, as I do not believe these services are popular with people my age, if you were to put where you were at or where you were going on one of these apps, it is pretty unlikely that someone you were friends with would see, and even more unlikely that someone you wanted to see where you were would see it.

SCVNGR seems to be the most interesting of all of them because you can play a game, and earn rewards towards getting yourself a discounted meal or towards some other type of reward for the place that you did the “challenges” at. The only problem that I see that could stop this app from being successful is that the place you are going has to have put the place on the app or else that app becomes useless to the person at the place. I do see how these apps could become popular in the future as more people spread the word about them and they become more popular. With a lot of people using them, they could become a very effective tool for people to communicate where they are and what they are doing. You would be able to see where your friends are, see what they are doing, know what places are fun, which ones are good to eat at, or which ones aren’t good at all.

Overall, these apps seem cool to use for people who actually go places, but for a teenager like me, these apps I am not sure they will provide any value.