Geolocation in the spotlight
20 May 2011
This article was first published in Data Protection Law
& Policy in May 2011
No avid reader of Article 29 Working Party opinions would be
surprised to see statements such as "location data from smart
mobile devices are personal data" or "the combination of the unique
MAC address and the calculated location of a WiFi access point
should be treated as personal data". However, when those
statements appear alongside references to the night table next to
someone's bed, or the fact that specific locations reveal data
about someone's sex life, one can't stop wondering whether an
intended clarification of the applicable legal framework to
geolocation services available on smart mobile devices is getting a
bit sensationalistic.
Let's get the basic facts right first: every electronic exchange
of information is recorded somewhere - emails sent, web pages
visited, telephone calls made, credit card transactions,
etc. It is in the nature of the digital age. Smartphones
and the like represent the latest form of communications technology
and, as such, mobile communications leave behind some of the most
sophisticated records that digital technology can generate. So
a full assessment of the rules affecting the use of smartphones
should go beyond a textbook interpretation of European data
protection law and look at whether the collection and use of this
information has an impact on people's privacy and data
security.
Some of the information generated by our day to day use of
mobile communication devices will no doubt be very
private. For example, the concepts of "traffic data" and
"location data" are carefully defined by EU law and their use is
strictly regulated because it is perceived as sufficiently
sensitive. Although there are some subtle differences, in both
cases the lawful use of such data normally involves obtaining the
consent of the individual. However, in the case of location
data, consent is not required if the data is anonymous.
This is a crucial point in the context of smartphones-generated
data which the Working Party Opinion does not fully appreciate in
its recent opinion on geolocation services. This is
unfortunate because instead of acknowledging the different types of
information that a smart mobile device may produce, all data is
dumped into the same bucket. The assumption seems to be that
all data collected through a smartphone device should be regarded
as personal data despite the fact that some of the data does not
identify the device's user, or that the uses made of such data will
never involve singling out an individual.
According to the Working Party, because location data from smart
mobile devices reveals intimate details about the private life of
their owner, the main applicable legitimate ground is prior
informed consent. Again, this is a massive generalisation of
the multiples modalities of geolocation services, many of which
will rely on anonymous data or, at least, data which is not meant
to identify or affect a particular user. Therefore, requiring
consent from individuals may go further than what the EU legal
framework intended.
For many human beings, life without a smart mobile device would
be unimaginable. That is a slightly scary thought and
regulators have a duty to scrutinise the data protection
implications of new technologies that have the power to radically
affect our lives. Clarifying how data protection law interacts
with continuously evolving geolocation services is a laudable aim
from which everyone can benefit. But unfortunately, a black
and white approach to this issue conveys an unhealthy sense of
panic and, even worse, distracts us from the fundamental challenge:
spotting the real threats to our privacy and security that may be
caused by rapid and imperfect technological development.