LA Department of Transportation Must Address Serious Privacy Threats Posed by Collection of Highly Detailed Scooter and Bike Location Data

Yesterday New America’s Open Technology Institute (OTI) and the Electronic Frontier Foundation (EFF) submitted a letter to the Los Angeles Department of Transportation (LADOT) and the Los Angeles City Council protesting the expansion of a policy requiring dockless mobility providers -- like companies that own and manage electric scooters and bikes -- to share detailed trip data with the Department of Transportation. This next stage of the policy is scheduled for implementation on April 15, 2019. OTI and EFF have expressed deep concern about how the sharing of this sensitive information could violate the privacy of Los Angeles residents, and about the lack of clear policies on data use, retention, deletion, and access/sharing.

LADOT’s Mobility Data Specification (MDS) already allows the department to demand that scooter and bike providers share timestamped route information regarding specific individual trips upon request. Although this practice has been going on for months, the government has not developed policies that clearly explain how it will use the data, how long it will retain the data, when it will delete the data, and the conditions on which it share data with third parties. Now, despite protests from civil society, LADOT is forging ahead with the next stage of the MDS, the “Agency API”, which requires that operators provide LADOT with raw trip data for each and every ride taken in Los Angeles.

As the letter explains, LADOT needs to address the serious privacy and civil liberties issues implicated by the Provider API before moving forward with any further stages of this policy. This must be done transparently, with real opportunities for stakeholder and community awareness and engagement.

Specifically the letter sent by OTI and EFF urges the City Council and LADOT to:

(i) formally recognize the sensitive and private nature of the trip data implicated by the proposed rule;

(ii) adopt real policies, in consultation with stakeholders and the public, providing safeguards for the privacy and civil liberties rights threatened by collection of this raw trip data;

(iii) delay moving forward with any further stages of the MDS (i.e., the Agency API) until LADOT has adequately addressed the privacy and civil liberties risks posed by initial stages of the MDS (i.e., the Provider API); and

(iv) commit to working with operators on solutions that will achieve its goals without sacrificing the privacy of Los Angeles residents.

The following quote can be attributed to Andi Wilson Thompson, Senior Policy Analyst, New America’s Open Technology Institute:

“The Los Angeles Department of Transportation (LADOT)’s decision to move forward with the implementation of the Mobility Data Specification “Agency API” on April 15, 2019 poses a dangerous threat to the privacy and civil liberties of Los Angeles residents. We urge LADOT and the Los Angeles City Council to reconsider this hasty action in order to take the time needed to engage stakeholders in a transparent process, and develop clear policies to protect user data.The sensitive nature of granular trip data requires carefully developed and articulated data protection processes and a recognition of the serious privacy concerns posed by the collection of this information.”