Thursday 21 April 2011

iPhone, but who's watching?

Location tracking revelations about Apple's iPhone are worrying. Below is an article I wrote for The Guardian a couple of weeks ago to explore the controversy . . .

Arriving at a new town hundreds of miles from home, how do you find a decent restaurant? Perhaps the mobile app TopTable and its reader reviews of nearby places to eat? Or you’re at a football match and you can’t wait to tell everyone who should be dropped and who saved the day. Try the mobile app Screach. It gives all the game’s spectators the chance to vote on the man of the match.

These are just two of a growing number location based services (LBS) – systems that use your location to send you information or let you take part in nearby activities. Others apps will tell you who’s available to date nearby or the nearest cashpoint. You can get discounts by “checking into” a store on your phone, as a loyalty scheme, and soon you may be able to get cheaper car insurance if you agree to your car being tracked to prove your driving skills and low mileage. Experts predict that by 2014 LBS will be so complete that it will be possible to locate you every second of every day, but they are developing so fast that regulation is uncertain.

“There is a general feeling that current regulation has not been looked at in terms of the mobile internet,” says Patrick Clark, a partner specialising in technology and communications at Taylor Wessing. The Privacy and Electronic Communications (EC Directive) Regulations (PEC) from back in 2003 are still the main governing provisions. “It is not definite that these catch the new app platforms, which are often not provided by the telecoms company, but by third parties who may not even be in the UK or the EU. The regulations may need to be looked at again.”

As well as helping the mobile user, location based services often make money by helping businesses to direct marketing to people at the time and place where it is likely to be most effective. Not the worst thing in the world, perhaps. But what if you do not want to reveal your location? What if the information is misused? Isn’t this leading us down the road to big brother?

A key issue is consent. People must opt in to their location being used, but when does someone agree to the use of this information, which would be covered as potentially sensitive personal information under the 1998 Data Protection Act? “The regulations require people to consent to the use of the information,” Clark says. “But this should be informed consent. The user must have had opportunity to read and understand what it means. But if I agree to an app provider using my location to give me directions, does this mean I consent to it using my location to send me adverts from nearby businesses?”

The way people use the mobile internet is not the same as the way people use the internet at home. At home can one is presented with the full forms and terms and conditions. On a mobile this is much more difficult to provide, which leads to concerns that people are not giving informed consent. They may want to know the nearest restaurants, but do they really consider the possibilities that this information may fall into the hands of the police, who may have rights to it to investigate a crime, or an adversary, who may get a court order for the information as part of a legal action. What happens if a person gives a lover, child or friend a new mobile phone, but doesn’t reveal that it has tracking enabled?

Philip James, senior associate in the media brands and technology team at Lewis Silkin, says: “Perhaps it would be a good idea to have a requirement to show an icon to indicate that a location service is in operation.” The issue of consent may also depend on the level of detail and the precise nature of the network. The PEC regulations define “location data” as indicating the geographical position of “a user of a public electronic communications service, including data relating to the latitude, longitude or altitude . . . the direction of travel . . . or the time the location information was recorded.

“If you have wifi on the phone and that is the means by which, for example, the shop you have walked into is processing location data then there is a query about whether the regulations apply. You may be considered not to be on a public network." And as for the longitude and latitude? “What level of detail requires regulation? Street, town, city, country? Information about which country you are in may not be seen as sensitive personal information for data protection, but it may be very important for other reasons, such as proving your domicile.”

From a practical point of view, pioneers of LBS argue that there is a shared interest between the consumer and the provider. The consumer does not get bombarded with irrelevant material, including marketing, and the provider does not waste time on people who are nowhere near relevant businesses.

Paul Rawlings, founder of Screach provider Screenreach, says: “What matters is how the company handles the data. We are living in a social world. People are sharing their thoughts on Twitter and sharing our location is a natural progression. We give the user a compelling reason to engage. This creates loyalty. They don’t feel that they have been advertised to.”

It is perhaps this perceived symmetry of interest that is fueling LBS. According to the Internet Advertising Bureau (IAB) it is evolving from being driven mainly by standalone services such as Google Maps to becoming an integral part of other mobile services such as social networking, including Four Square and Twitter. Jon Mew, IAB director of mobile and operations says: “Done responsibly, location based marketing provides an extra service to consumers. We have probably only scratched the surface of this so far, but things will only work if consumers accept them and they know there are laws and regulations to protect them.” The message, then? Read the small print.