The UK Geospatial Commission’s policy paper on location data ethics proposing shared values to build public trust in the use of location data is a laudable effort. The paper, Building public confidence in the use of location data, lays down ABC’s of values – Accountability, Bias and Clarity – for the use of location. It takes the position that adhering to these values will maximize public trust and confidence, ensuring that location data can be used, shared and re-used with full public support.
Accountability entails ensuring location data is responsibly managed. Bias involves acknowledging that location data, particularly involving communities, could be skewed. Clarity ensures that the use and benefits of location data is spelt out without any ambiguity and is understood by all.
The kneejerk reaction in the US
In what could deal a critical blow to the location intelligence industry in the US, a Bill seeks a blanket ban on the collection and sale of location data in the country and even action against violators.
Introduced by Sen. Elizabeth Warren and a group of other Democratic lawmakers in early June, the Health and Location Data Protection Act (HLDPA) comes following recent media reports that “data brokers” were selling location data on people visiting abortion clinics in states where abortion is banned. There are also widespread concerns, and justifiably so, that harvesting health and location data could be used for profiling and exploiting, and even spying and stalking of people, especially now with the US Supreme Court’s Roe v Wade ruling.
The Health and Location Data Protection Act seeks to make it “unlawful for data brokers to sell, resell, license, trade, transfer, share, or otherwise provide or make available any of the following forms of data, whether declared or inferred, of an individual”.
What’s extremely worrisome is that the Act defines “data broker” as “a person that collects, buys, licenses, or infers data about individuals and then sells, licenses, or trades that data”. This brings almost the entire geospatial and location industry under its ambit.
“Even if a geospatial company believes it is not subject to the Act, its customers might and require ‘authorization’ by individuals. This would be impossible for many geospatial companies to obtain, as the Act provides that the “authorization” is similar to that required for protected health information under Health Insurance Portability and Accountability Act of 1996 (HIPAA),” Kevin Pomfret, spatial law and data privacy expert, wrote in a LinkedIn post.
“Making things even more complicated is that the term ‘location data’ is defined as ‘data capable of determining the past or present physical location of an individual or an individual’s device’. This definition is much broader than is found in current U.S. privacy laws — such as the California Consumer Privacy Act (CCPA) or Virginia’s Consumer Data Protection Act (CDPA) – and would likely include data types that many members of the geospatial community do not consider to be sensitive,” he added.
However, as Keith Masback, former President and CEO of the United States Geospatial Intelligence Foundation (USGIF), pointed out, “We have been discussing for years now that either our sector is going to need to sort out how to manage [a situation like] this, or it would happen to us. And here we are!”
The Act seeks to empower the Federal Trade Commission and even individuals whose interests have been threatened or adversely affected to take action against the violators, including obtaining damages, restitution and compensation. This could amount to a penalty not exceeding 15 percent of the revenues of the company concerned during the preceding 12 months.
The value of location data
Any data with a geographic element is known as location data. With the “where” component becoming critical to businesses and governments, location data is now an integral part of today’s digital era. Apart from being central to how we live and move, location data is also critical in tackling pressing global challenges, be it the COVID-19 pandemic or climate emergency.
Location data can be personal data when it relates to individuals who can be identified, either directly or indirectly. However, aggregated population or traffic data or data that describes the location of a place not linked to an individual is not personal data.
As the use and benefits of location date grows, there is an uptick in demand for faster and more automated data. While this makes location data a powerful tool, it all comes the need for building a trusted data environment among users.
The data privacy debate
Debates around data privacy are not new, but caught the public attention possibly the first time in 2018 when the Facebook-Cambridge Analytica scandal was exposed. Since the outbreak of the COVID 19 pandemic, the debate has gained momentum as governments and organizations resorted to intense tracking and other data-driven tools to monitor and curb the spread of the virus, or even provide services such as online shopping or health care. Such far-reaching intrusion into individual privacy was unthinkable earlier.
Admittedly, the location intelligence industry played an invaluable role during this critical time. However, there were also concerns that this intrusion and violation of privacy would become a norm in the absence of stringent laws in large parts of the world. So far only a handful of countries have data privacy and protection laws in place, the primary among them being the European Union’s General Data Protection Regulation (GDPR) which came into effect in May 2018. “Outside the EU, very few countries have data privacy frameworks that are aligned with OECD guidelines or GDPR,” notes a report from the Consumer’s International.
The location industry in the United States is largely unregulated by federal law, and in the absence of a comprehensive data privacy legislation on the lines of the European GDPR, there are increasingly instances of “unethical” business practices, and the biggest of the tech companies, including Google and Facebook have been hauled up by the courts for blatantly profiting selling sensitive information of people.
In addition to the Health and Location Data Protection Act proposed by Sen Warren, there is another legislation on data privacy and protection in the making in the United States. Released on June 3, the American Data Privacy and Protection Act, (ADPPA), is the first comprehensive privacy proposal to regulate the national data privacy and data security framework. However, the bill, even though has already gained bipartisan, bicameral support, is likely to face an uphill task.
Why location data is unique
While privacy and protection of all types of data is important, location data is somewhat special because of its ubiquity as compared to any other data type.
“This ubiquity of human mobility data, plus its high level of detail and the inferences it offers, raises unique ethical considerations,” notes the UK Geospatial Commission. This includes individual location data, and also that’s linked to groups and communities with shared characteristics, which may lead to profiling and bias.
There is also a kind of vulnerability attached to location data because of the safety implications that can arise from its breach. For instance, there are widespread concerns in the America now that there could be an increase in vigilantism, surveillance, harassment against those seeking or providing abortions.
As the pandemic proved, people largely support the use of personal data when it is for larger public good. To retain the public trust, ethical use of location data is vital. This begins with putting in place the right policies that put individuals at the core.
“All users of location data have a stake in building an ecosystem in which the public has confidence and trust. Doing so will allow us all to maximize opportunity, to drive public benefit and to grow economic value,” says Edwina Dunn, Independent Commissioner, UK Geospatial Commission and Interim Chair, Centre for Data Ethics and Innovation. An environment of trust will encourage and ensure increased data sharing.
Disclaimer: Views Expressed are Author's Own. Geospatial World May or May Not Endorse it
