Location data and contact tracing
Location-based services (LBS) use location to deliver navigation, advertising, gaming, payments and more, drawn from satellite (GPS/Galileo), cell-based mobile network, and chip-card data. Location data is an identifier in the definition of personal data, so if it can identify someone (alone or combined), it is personal data. The big risks are stalking/harassment and inadvertent disclosure (e.g. fitness apps exposing military bases). Demanding GPS for an unrelated purpose is not freely given consent. COVID-19 contact tracing apps must be voluntary, proximity-based not location-based, and DPIA'd.
| Source | Examples |
|---|---|
| Satellite network | GPS and the EU's Galileo system - navigation, security, social networking |
| Cell-based mobile network | Cell ID, plus Bluetooth, Wi-Fi, NFC and RFID - location services, ads, contactless payments |
| Chip-card | Payment cards, building access cards, metro/travel cards |
Mobile phones and apps are the most prevalent source of location data and can also infer location from user behaviour or from an IP address. Location data is an identifier in the definition of personal data: if it can identify someone alone or with other data, it is personal data. In employment, tracking a delivery vehicle also tracks the driver, whose location data is their personal data.
Requiring GPS to be activated in a photo-editing app for behavioural advertising is not freely given consent, because GPS is not necessary for the core service. App developers must check the legal basis covers all purposes and that purpose limitation is met.
- Location can be misused for stalking or harassment
- Apps may disclose sensitive data unintentionally - e.g. fitness apps revealing US military bases and personnel
- Even with location services off, an app vulnerability could leak location
- Location history (clinics, churches, friends' homes) can reveal political opinions, religious beliefs or medical conditions
| Requirement |
|---|
| Use must be strictly voluntary; apps stop collecting once no longer necessary for the pandemic |
| Must use proximity data with other devices, not location data |
| DPIAs must be conducted before deployment |