The Federal Communications Commission is out with a report on location-based services that outlines government and industry efforts to address the privacy issues surrounding those very services.
The FCC declined to adopt any regulations or best practices, but stated it would “continue to monitor industry compliance with applicable statutory requirements and evolving industry best practices.”
According to details outlined in the report, the FCC has identified key privacy issues implicated by location-based services. Such issues include:
Notice and transparency. After noting the importance of companies informing users of what the company is doing with collected LBS information, the FCC recognized various industry efforts by CTIA, the Mobile Marketing Association, the Direct Marketing Association, and private companies to provide users with notice of how location-based service information is used. However, the FCC cited numerous reports that concluded many apps lacked basic privacy policies.
Meaningful consumer choice. Consumers should have an opportunity to tell a company what it can and cannot do with their information. The FCC noted that most choice is provided as “opt-in,” i.e. the user must consent before the information is used, but that challenges arise between real-time meaningful choice and user experience. Industry standards, such as CTIA, are identified by the FCC as providing guidance on consumer choice.
Third party access to personal information. Noting that many entities, such as the carrier, operating system, and app developer, may have access to LBS information, the FCC identified app developers in particular as possibly not having privacy standards in place. The FCC noted that entities like the Future of Privacy Forum and TRUSTe are recommending app developers adopt privacy practices, and that mobile operating systems and carriers are requiring apps seek permission before using location-based services.
Data security and minimization. The FCC noted that because location-based service data is considered particularly sensitive information, heightened security requirements can be reasonably expected of the industry. The FCC also noted that as little data should be stored for a short a period as possible to lessen security breaches, although there is a tension because law enforcement would find location data valuable suggesting longer storage times would be valuable.
For now, the FCC concludes that the immediate course of action for the agency primarily involves monitoring these issues for the foreseeable future.
