PH COVID-19 Client Alert Series: Location Privacy in a Crisis—Considerations for Businesses
The fight against COVID-19 has gone mobile. Israel has approved
These initiatives bring new tools to public health officials’ fight against COVID-19. But privacy concerns are at their zenith when location is involved. Geo-tracking data is notoriously difficult to
Debates in the press over government geo-tracking also have the potential to heighten scrutiny of businesses that leverage location data. Recently, the major U.S. wireless carriers became the target of an FCC investigation into third-party data sharing arrangements involving customer location data. The Commission has proposed
With the world being re-shaped by COVID-19 and location data at the forefront of public policy, companies should take this time to engage in self-assessments and look with fresh eyes at their use of location data. Geo-tracking smart devices is an essential value add to many businesses—including foot-traffic analysis for retailers, geo-fenced emergency alerts and local news highlights in the media sector, and traffic-pattern optimization for personal vehicles and commercial delivery fleets. We recommend that companies keep four principles in mind when conducting such privacy assessments.
Know Your Data. Aligning privacy interests with enterprise risk requires mapping and categorizing the data your company holds. Location data comes in many forms—ranging from precise GPS coordinates toaggregate, de-identified “heat maps”. The more precise the data, the higher the privacy risk, so it’s critical to know which elements you have and where they come from. With GDPR enforcement in full swing (and CCPA enforcement and other state regulations on the horizon), companies need to know their data well.
Privacy By Design. Workflows and projects that involve location data should be designed with privacy in mind. Data minimization is critical to this process. Asking how your company can reduce (or eliminate) the retention of location data can vastly reduce the sensitivity of data sets and privacy concerns.
Third-Party Use and Contract Hygiene. Establish clarity with vendors and other third parties on the use, processing, and retention of location data. If sourcing location data from a vendor, obtain commitments from the vendor that the data was collected legally and seek indemnification for any issues. Specify in writing the data elements to be shared and double-check that data sets comply with contractual standards.
The regulatory landscape governing the collection, use, and sharing of location data is changing rapidly, and businesses need to be prepared for tightening of consent and sharing standards in the future. The attorneys and experienced consultants in our Privacy and Cybersecurity practice group help clients navigate these issues every day. We are available and ready to help you navigate the privacy landscape in this time of unprecedented change and uncertainty.