Public debate and legal scrutiny continue to surround Uber – the mobile app that connects users and taxis in real time. Despite facing legal challenges in at least six countries, considerable protest by local taxi drivers, including a major strike in Brussels in March 2015 and an actual conviction of an Uber driver before the Belgian police court, Uber continues to drive forward its successful mobile app.
Driven by geo-location tracking
Uber’s consumer-to-consumer (C2C) business model is an offspring of the sharing economy, the socio-economic phenomenon that began in the mid 2000’s and refers to peer-to-peer interaction as a substitute for the traditional producer-consumer relationship. C2C apps such as Uber thrive on a continuous feed of voluntary user-generated content. Uber offers users on both ends – both the taxi driver and rider – a meeting place and then synchronises respective user interests until a match is found between a rider and a driver.
The technology used to connect drivers and riders is known as geo-location tracking, which is incorporated in almost any mobile smart device nowadays. This allows Uber not only to trace its users with pin-point accuracy compared to traditional taxi services, thus improving pick-up times, but it also increases users’ chance of finding nearby drivers or passengers.
Geo-location data services are used more frequently than the average user might be aware. Many online maps and navigational tools, geo-tagging of content on the internet, geo-personalised services, child control and location-based advertising all conveniently make use of a user’s location to run their service. This sort of data can be retrieved through three main types of infrastructures: GPS (satellite-based) technology, GSM (antenna-based) base stations and Wi-Fi access points.
‘God View’ in Question
Specific data protection concerns have been raised in light of Uber’s geo-location technology, more specifically its “God View” capability, which allows the company to see all Uber cars in a city and those users who have flagged cars. Incidents occurred in the US in which Uber staff casually made use of this capability and there have even been reported cases where non-Uber employees were granted access as well.
The risk of data controllers, like Uber, who have the means to indirectly, though highly accurately, identify individuals by locating a Wi-Fi access point and linking this to a unique address, have unsurprisingly piqued the interest of regulators. Back in 2011, the EU’s working party 29 issued an opinion on the data protection issues surrounding geo-location tracking which said they should meet these criteria:
- Specific, freely given and informed consent: the golden rule is that a user whose location is about to be traced, must have the option to give informed consent prior to the processing of this location data. Mere opt-out mechanisms or settings which enable consent by default, are not adequate to meet this criteria. This also means that once consent has been given, the user must have the option to voluntarily withdraw at any given moment in time. The working party favours the idea of services providers to ask users to renew their consent annually.
- Comprehensive, easily accessible and understandable notice: to allow users to give informed consent, data controllers must provide them with comprehensive, easily accessible and understandable notice about geo-location applications and services.
- Data access and correction: the working party also encourages data controllers to set up online platforms where users can access their data in a safe manner and are able to rectify or delete data where necessary.
- Limited retention period: lastly, the working party stresses the importance of having retention policies in place which allow for the geo-location data to be deleted as soon as they are no longer required for the purposes for which they were initially retrieved.
This means that C2C app providers intending to use geo-location data, at least within the EU, must have a data privacy policy in place that requires the user to grant adequate consent and online platforms that allow for users to verify their data.
Uber has since amended its data protection and privacy policies and declared on its website that its privacy policy should be updated to meet these specific concerns.
Uber is not alone in its use of geo-location data – this trend is on the rise with many similar C2C apps. But as geo-tracking continues to be used to grow the sharing economy, companies must be transparent in their use of such data and consumers must be savvier to the potentially intrusive nature of this technology.
Sylvie Rousseau is a partner and Lauren Cuyvers is an associate at Olswang
This advertisement feature is provided by Olswang, sponsors of the Guardian Media Network’s Changing business hub
