The Responsible Use of Spatial Data

4.1 The Nature of Spatio-Temporal Data

Spatial data, data about the physical nature of the world and about the social and economic activities that take place may be described as Spatio-Temporal data, in that it reflects the nature of the world at particular locations at particular times. In simple terms an atlas of Europe published in 1912 would represent now historic national boundaries, place names etc, in the same way a smartphone map of traffic conditions for San Francisco represents the amount of congestion on roads a few seconds previously.

With the advent of smartphones and ability to collect and share information about individuals locations has become mainstream, it is the ability to place someone at a specific location at a specific time that illustrates both the value and the potential risks of such information. It is useful to think of time an space and two sides of a coin, an individual can be at only one location at a specific time, and vice versa at a specific location at a particular time. In general terms if these data are abstracted or reduced in resolution both in terms of time and definition of location the information value is decreased along with the inherent risk of exposing an individuals location.

4.2 Use Cases

4.3 Misuse Cases

5.1 The Link Between Ethics and Law

There is a virtuous cycle between data ethics and law, brought about by globalization and the localized nature of laws. Where ethical concerns within a region accelerate faster than other areas, legislators create laws that provide protections deemed necessary by citizens. These laws often provide templates for other regions, potentially influencing prevailing regional ethical concerns. In the case of data privacy, GPDR has provided a template that many countries have adapted, resulting in a framework of rights that have found their way into legal frameworks for privacy. The following rights broadly capture these concerns. Three laws were referred to in order that commonality across regions could be confirmed. These were the General Data Protection Regulation (GPDR), California Consumer Privacy Act (CCPA), and Australian Privacy Act. Where a right is included in these laws, it is indicated under the corresponding right.

5.2 The Right of Access

The Right of Access gives individuals the right to obtain a copy of the personal information held about them. It also includes supplementary information such as the purpose of processing, categories of personal data processed, recipients or categories of recipients, the right to object and instructions on how, and the existence of automated decision taking based on the information held.

5.3 The Right to Know

The Right to Know gives people the right to be informed about the collection and use of an individual’s personal data, which extends to a number of additional obligations by the manager of that data. Additional obligations include identification of data managers and protection officers, processing purposes and interests pursued, intention to transfer and the intended recipients, duration of storage, and rights of the data subject including the ability to withdraw consent.

5.4 The Right to be Forgotten

The Right to be Forgotten is the right to request erasure of data. If the data have been made public, or passed onto to third parties, all reasonable measures must be taken to inform recipients that all copies of the data originating from their disclosure must be erased.

5.5 The Right to Opt-out

The Right to Opt-out is the right to revoke access to collection of more data, or the use of existing data for the purposes originally consented to (e.g., direct marketing).

5.6 The Right of Correction

The Right of Correction is the right to have your personal information that is incorrect be corrected.

5.7 Geolocation Specifically

CCPA goes further from a location perspective, including geolocation in the definition of personal information. This has given rise to a number of additional responsibilities for data managers. Privacy policies require updating to reflect any capture of geolocation. Users should be required to opt-in with just-in-time notice prior to collection of geolocation. CCPA requires this consent to be provided separately to any general End User License Agreement, privacy policy, conditions of use, or similar document. To comply with the Act, collection of geolocation can only commence after a data manager can prove that consent to collect (and transmit if applicable) was given, that consent was not later withheld or revoked, and that the captured geolocation precision is not greater than the precision for which consent was given.

5.8 A Note On Legal Frameworks

It's important to note that the law outlines our minimum compliance requirements. The existing laws give people rights, but they don't necessarily protect them. Often people are not necessarily aware that their data are being collected and shared because that is hidden somewhere in the privacy statements and terms and conditions of use. People rarely read these documents. Equally, people are often unaware of their rights, and therefore ill equipped to assert the rights outlined above when they are violated.

Individuals rarely feel the risks associated with mass collection of data. This gives great power to the collectors and users of the data who may well exploit that power for personal gain rather than considering the protection of the individuals and groups that might be harmed and affected by their actions.

From an ethical standpoint, it is the responsibility of collectors and users of data to protect individuals and groups whose data they collect and use. This includes giving them control over their data, or to proactively meet the rights discussed above so that people can be confident that their data are properly managed. For example, by:

• giving people by default clear access to their data;
• giving people by default control and ownership over the collection and use of their data; and
• erasing people's data by default at a certain point unless people opt-out.

Collectors and users of data should take this responsibility seriously, and consider the design choices in section § 7.3 Design Choices in this note.

5.9 More Information

For more information on these legal frameworks, you can follow the links below.

6.1 More Information

For more information on these ethical frameworks, you can follow the links below.

7.1 Efficacy of Mobility Data

With the widespread adoption of smartphones and other devices which have direct or indirect abilities to be geolocated, the interest in developing new applications and services which make use of this valuable information have rapidly increased. The Location Based Services market grew rapidly in the last decade but not all applications of mobility data were successful, in many cases the expected benefits were not achieved.

For example an early use case in mobile marketing conceived of a potential customer walking past a shop and automatically receiving notifications from the shop owner offering special offers and other incentives. The reason this did not happen is that intrusive advertising would not work and would only annoy potential customers. In this instance, the use case would not produce the results desired, it is an issue of Efficacy – In simple terms would it even work?

Other issues may result from the difficulty of using Global Navigation Satellite Systems (GNSS) indoors or in dense Urban environments, the power consumption and impact of GNSS receivers on smartphone batteries preventing continuous tracking applications. During the COVID-19 pandemic, contact tracing applications were limited in efficacy because of concerns that citizen location my have been collected, even though these applications were not location based in most cases.

To prevent these type of issues realistic operational testing and the development of extensive user testing should be undertaken to prove the efficacy of the application before the application is introduced and spatial data captured as a result.

There is context to efficacy of course, you might want to try a technique that is unproven if circumstances are severe, a global pandemic might be such an example? If so would it be acceptable to experiment first to gather data using a time limited application?

Linked to this would be the efficacy of an application over time. While it might be acceptable to collect information during an emergency, for example monitoring the location of the population during a hurricane evacuation, the location data would and should have no value when the storm has passed.

This level of specificity of use is a general requirement of most data protection legislation, in that data should only be collected for a particular purpose – so you would be prevented from using the data later for any other purpose.

Related to the temporal aspect of such data collection of course is the spatial context, an application collecting information on the movements of a commuter in Paris should not collect data when the user is on holiday in London or even Nice. Likewise an app developed to monitor adherence to a quarantine requirement should only operate for the duration of the specific event.

7.2 Equability

It’s easy to imagine the development of an application that uses a device's location to validate financial transactions to minimize fraud. Transactions will only be valid if the device is at the same location as the retail purchase. Such applications have been developed although they have not been widely deployed because of questions of efficacy as noted above.

But is it acceptable to expect everyone to have a smartphone with Ambient location technology to be able to make purchases?

Access to services should not rely on access to expensive sophisticated devices. An alternative needs to be available for those without or unwilling to use smartphones for example.

Access to technology may also vary for other societal or cultural differences and this may not be easily understood or unexpected. It there is an urgent need to build solutions based on ambient location, active measures at a governmental level may be needed for example subsidizing the purchase of smartphones and or data plans. Another approach may be making available dedicated devices as in the case of Singapore’s TraceTogether tokens https://www.tracetogether.gov.sg

It may be the case that for some applications and systems restricting the use of location data collection may result in a reduced user experience for example the incognito mode in Google maps cannot access your past search history or preferred mode of transport preferences. However such limitations should be explained and the decision left to an individual's choice.

7.3 Design Choices

For many developers of applications or services that need to implement spatial data collection and sharing discussions around the ethical approach to take may appear rather esoteric or at least academic in nature. How one builds an app or service that uses ambient location in a responsible way is of course a question of engineering design choices

Here a number of design principles are presented, that are hopefully clear and pragmatic. There will of course always be scope for compromises and seldom are choices clearly right or wrong, there must be the ability to use a nuanced approach.

These design principles are by no means comprehensive but a useful starting point.

It should be clear the collection and sharing of location data are different things. There are many use cases that might require a user's location to be obtained, but the data do not need to be stored on device or on a server after the location is used.

Clearly a ride sharing application needs to be able to access your phone's location to arrange the dispatch of the closest car. However, the collection of your location data while you are walking about for analytical purposes is not necessary for the operation of the service and you should be able to opt out of this form of collection if you wish.

Even if the collection and sharing of spatial data is not optional there should be an explicit notification and ongoing reaffirmation of the user's agreement. This is important particularly if location sharing is a background process. Under these circumstances, a user interface indication should be provided. Section § 8.2 A Design Language for Location Sharing describes symbols for this purpose.

Of course the user should be able to change their mind and temporarily or permanently stop sharing at a time of their choosing.

Again reinforcing the first principle collection and sharing are separate activities and should require separate user consent.

This is already a key foundation of most good data protection regulations, you need to explain clearly why you are collecting location information and how it will be used.

Many public transport providers collect journey information for resource planning purposes. Although it might be useful to know passenger movement prior to making their journey, if they don’t state they will use the data for that purpose, they must not use it!

Again a key data protection principle is to only collect the minimum amount of data required, there is no allowable concept of “nice to have in case we need it”.

In spatial terms there is a particular issue with resolution both in terms of time and space, there are very few applications outside of turn by turn navigation that require precise real time location data.

For your hyperlocal weather forecasting app Wi-Fi or cell based positioning to within a hundred metres is easily good enough!

Differential privacy provides a promising privacy preserving technique for spatial data. It is based on injecting random noise into spatial data so that both the level of privacy and usefulness of the data is quantified and controlled.

There needs to be a really, really good reason for Ambient Location information not to be anonymous. For most of the current popular applications where Ambient Location information is used to “sense” the world, anonymous data are all that is required.

It might be that some considerable effort, as in differential privacy, must be applied to data to maintain privacy, but there is great risk associated with linking individuals to their location.

The recent debate on different approaches to contact tracing, centralized vs. decentralized is illustrative here. In both cases the data collected are anonymous however there is greater risk in the centralized model that there could be a security compromise and data “could” be identifiable at least theoretically.

The risk comes from storing the data in one location as opposed to distributed on individual devices. Against this risk of course there may be counter arguments that from a perspective of epidemiology it is valuable to be able to view the graph of user interactions only possible with a central repository of data.

Regardless of where Ambient Location data are stored it should be secure, encrypted both “At Rest” e.g. on the device or server but also “In transit” while moving across the network between device and server.

The data that can be considered to be personally identifiable extends beyond the obvious name, address and telephone number and there are grey areas specifically with types of spatial data.

Any data that, with the favorite legal term of “reasonable effort”, can be used to identify an individual data subject is PII. So the IP address of the client using your service is PII, as is any device ID specific to a mobile phone for example such as the IMEI or IMSI code.

These are obvious, but spatial imagery also brings unique challenges. While satellite imagery and aerial photography can be argued to be not PII as the resolution of imagery and the generally vertical orientation of imagery makes identifying individuals impossible, the same cannot be said for terrestrial imagery.

Because it would be possible to combine an image taken at ground level where an individual could be recognized, with metadata of when the image was acquired it is necessary for services such as Google Maps Street View and Apple's Look Around to blur faces and car registration plates.

Is the collection of Ambient Location Information temporary and limited to a defined period of storage, and if not why not ? Again of course there may be applications where the user might want data to be stored indefinitely. For example, storing location history in Google Maps is a convenient way relive travels. However, without the explicit consent from the user, such historic information should be removed after a sufficiently short and specified period of time.

7.4 Privacy-preserving Approaches to Data Collection

An important emerging technique to ensure the privacy of individuals' location data is differential privacy. Differential privacy helps developers of spatial services to derive insights from data while at the same time ensuring that those results do not allow any individual's data to be distinguished or re-identified. Differential privacy works by injecting noise into statistical or spatial functions, reducing resolution of data in time and space while maintaining the information content. Differential Privacy techniques crucially also offer testing mechanisms which allow the success of the techniques to be quantified and varied in effectiveness for particular use cases.

8.1 Transparency Concerns

Spatial data is a term that is not well understood by the public and can be a barrier that prevents constructive engagement. However, people are familiar with personal location and this offers a simple example of spatial data which can help engage users in meaningful discussion by use of more inclusive language.

8.2 A Design Language for Location Sharing

Having identified the key factors to consider when sharing or publishing spatial data online, the next step is to communicate those ideas in a simple manner that is easy to understand and remember for all users, including the general public.

How the guidance is applied will depend on the particular use case, but it is important to explain the aims clearly so that content creators have the knowledge and confidence to share their own spatial data in a safe and responsible way.

8.2.4 Overall Concept

User awareness should be raised with a simple prompt that location data sharing requires proper consideration.

8.2.5 Thought Process

Users should be quickly reminded of the thought processes involved in safely sharing location data, as outlined above.

8.2.6 User Interface

Developers also have a responsibility to highlight when spatial data are being used. Most modern web browsers display safety-critical information next to the web address to confirm whether network access is encrypted or that the browser is accessing the user’s camera or microphone with easily recognized icons such as a padlock for encryption. Spatial data should be similarly represented using a well-known icon such as the location pin so users are aware that their location is visible to others. For example, when a photo is taken using a smartphone, the user interface should clearly display whether or not geotag information is included.

9.1 The Role of the Regulator

As discussed in section § 5.1 The Link Between Ethics and Law, ethics and law guide each other. Particularly in times where public or personal safety are concerned, ethical lines can grey with regard to the sharing of location data, as was evidenced by the COVID-19 pandemic of 2019. Here, the role of the regulator is to outline what controls may be necessary to ensure that individuals are protected from harm and breach of privacy.

Other grey examples include tweets during crises that can be used to actually detect the crisis, but also show the user's location in real time. The US Geological Survey Tweet Earthquake Dispatch analyzes social media, and uses geolocation combined with machine learning to detect earthquakes. This analysis is capable of detecting earthquakes faster than conventional scientific instruments which can take up to 20 minutes to perform the same task, albeit more accurately. However, the release of information that provides a location of activities conducted by a particular target group could be used maliciously. For example, geolocation of dating apps could be used by a predator to find common meetup spots where individuals will be alone and may not be able to identify them as strangers.

Location is often used as the means of achieving data integration. This too has its risks. Data which cannot otherwise be linked together can be using the location dimension, and in a way that helps a subject to be identified that might otherwise not be.

The role of regulators is to provide the guard rails that help provide confidence to users that their data will be protected, and to developers that they know their obligations as data managers. To build trust, regulators must ensure that user rights and developer obligations are clearly explained, easily accessible, and broadly understood. The explanation must cover how each regulation protects the citizen, and how they would pursue their rights should a developer breach them. Finally, regulators must also ensure that developers are held accountable for breaching their data management obligations.

9.2 Examples of Good Practice