Federal “Privacy” Legislation, Investigation & Regulation: A Threat to the Geospatial Community

Federal “Privacy” Legislation, Investigation & Regulation: A Threat to the Geospatial Community John Palatiello, MAPPS Executive Director Kevin Pomfret, Centre for Spatial Law and Policy presentation to NGAC December 7, 2010 - Washington, DC

A series of Federal actions in legislation, investigation/enforcement and regulation could result in a serious threat to the geospatial community resulting in unintended consequences, poorly defined terminology, and restrictions that could hamper the ability of firms, agencies and organizations to collect, use, share, or apply geospatial data.

Legislation • H.R. 5777 – Best Practices Act, introduced by Rep. Bobby Rush (D-IL) • Draft bill (not introduced), by Rep. Rick Boucher (D-VA) • Potential Senate bills in 2011by Sen. Mark Pryor (D-AR), Sen. John Kerry (D-MA) and possibly others

Legislation • Rush: • 1) far too many companies that collect and use consumers' personal information have not dealt in a fair and above board fashion with consumers about the types of personal information they are collecting, how they are using that data, and who they are sharing that data with; • 2) most consumers are powerless to control, in any meaningful way, how and to which parties their personal information and data should flow; and • 3) there were far too many instances in which the flow of that data defied consumers' reasonable expectations about how that data might be used and shared.

Legislation • H.R. 5777 - Building Effective Strategies To Promote Responsibility Accountability Choice Transparency Innovation Consumer Expectations and Safeguards (BEST PRACTICES) Act - to foster transparency about the commercial use of personal information, provide consumers with meaningful choice about the collection, use, and disclosure of such information, and for other purposes.

H.R. 5777 • ‘‘covered information’’ means, with respect to an individual, any of the following: (i) the first name or initial and last name; (ii) a postal address; (iii) an email address; (iv) a telephone or fax number; (v) a tax identification number …

H.R. 5777 • Except as provided … it shall be unlawful for a covered entity to collect or use covered information about an individual without the consent of that individual … • ‘‘sensitive information’’ means … precise geolocation information and any information about the individual’s activities and relationships associated with such geolocation;

H.R. 5777 • “precise geolocation information” is not defined

Investigation/Enforcement • Federal Communications Commission (FCC) is investigating Google’s activities including photographing neighborhoods for its “Street View” feature • Associated Press, November 10, 2010

Regulation • Federal Trade Commission staff report, “Protecting Consumer Privacy in an Era of Rapid Change”, issued December 1, 2011

Regulation • “The Commission staff has supported affirmative express consent where companies collect sensitive information for online behavioral advertising and continues to believe that certain types of sensitive information warrant special protection, such as information about children, financial and medical information, and precise geolocation data. Thus, before any of this data is collected, used, or shared, staff believes that companies should seek affirmative express consent.” • Does not define “precise geolocation data”

Issues, Problems & Concerns • Legislation exempts government, but not government contractors • Boucher memo claimed “However, there is no law or regulation that generally governs the collection, use, and sharing of location information, whether real-time location information or historic data collected over time” • Further regulation is unnecessary and would create conflict and confusion among such regulatory schemes (state licensing, satellite licensing)

Issues, Problems & Concerns • Result in unintended consequences, thwart legitimate and desired business activities, or deny citizens and consumers the products, technologies, data, devices, and services navigation and other location based services they are demanding in the marketplace (E-911, electronic lost and found)

Issues, Problems & Concerns • To require that any geospatial firm to obtain “affirmative express consent” from every citizen about whom precise geolocation data is to be collected is impractical to the point of being impossible. This would require every citizen to be contacted and approval obtained before parcel, imagery, planimetric, transportation, or elevation data, or any other geolocation data can be collected, used, or shared.

Issues, Problems & Concerns • Private Right of Action • What is precise geolocation information? • How is location privacy different than other privacy issues: • e.g. financial records, medical records • Who it responsible for deciding? • Impact on future applications • Smart Grid • ITS

Suggested Action • NGAC comment to FTC or NGAC recommendation to FGDC/Secretary of the Interior to comment to the FTC

Federal “Privacy” Legislation, Investigation & Regulation: A Threat to the Geospatial Community