Privacy regulation tries to catch up with the privacy implications of the mass collection and usage of data location. With technological advancements over the last decade, the location of personal devices can be identified within a few feet of accuracy. This creates privacy implications as background applications and other third-party vendors may be able to track an individual’s movement in real time, with incredible precision.
Sensitive Location Data is Protected
This capability creates privacy concerns as location data reveals sensitive information about an individual’s private life–implicating social, legal, and personal interactions that are not meant to be shared. In 2018, the United States Supreme Court (Carpenter v. United States) added its voice and authority to the issue, holding that the government’s acquisition and review of the defendant’s cell-site data was a Fourth Amendment search. This ruling was not a foregone conclusion, but privacy professionals, concerned about misuse of an individual’s private location data, welcomed the ruling.
While the government’s use and misuse of location data raises concerns, it is the often unregulated private sector’s collection, tracking, and use of this sensitive information–often unknown to the consumer–that raises significant hazards.
Privacy Law Developments
Cobun Zweifel-Keegan, from IAPP, provides this helpful update on the latest privacy law developments related to sensitive location data, and many of the operational take-aways that companies should consider and incorporate into their practices. Among other helpful points, he provides this reminder about collecting data from third parties:
Due diligence is important when collecting data from third parties. Contractual safeguards alone are not enough! Monitoring third-party consent mechanisms is a great first step, but this should be coupled with corrective action when issues are identified. Audit the process by which your suppliers obtain consent and cease using location data that was not obtained with appropriate consent. If you don’t, you could get hit with a “means and instrumentalities” charge for facilitating unlawful data collection.
As the legal framework continues to evolve, it is important to review your company’s practices and methods to ensure compliance and efficiency.
