Location privacy is on the minds of lawmakers from both parties with provisions about disclosure, data collection and sharing in more than half a dozen bills. There is also language in a House appropriations bill nixing the use of federal funds for GPS tracking.
One bill that was passed by the House would mandate the establishment of a policy to protect consular personnel from being tracked by consumer devices including those with GPS receivers. The Protecting Diplomats from Surveillance Through Consumer Devices Act (HR 115) — which has been in the hands of the Senate since January — would cover U.S. government employees, contractors, locally employed staff and members of other agencies working at, deployed to or stationed at U.S. diplomatic and consular facilities.
A bill passed by the House Appropriations Subcommittee in May also targets tracking. It says none of the monies allocated in the legislation to fund the Department of Transportation may be used to mandate “GPS tracking in private passenger motor vehicles without providing full and appropriate consideration of privacy concerns” described in the Administrative Procedure Act.
None of the other geolocation-related bills, however, have made it out of committee as of press time. The Information Transparency & Personal Data Control Act (HR 2013) sponsored by Rep. Suzan DelBene’s (D-Washington) has the most support with 15 co-sponsors. This bill would mandate that controllers — that is those who determine “the purposes and means of processing sensitive personal information” — must get an affirmative and express opt-in from those whose data is being sought. This includes opting in for the collection of that person’s data as well as its processing and storage and any sharing of the data with third parties. The bill also requires a clear data use and privacy policy and the option to opt out at any time.
Probably the most ambitious piece of location-related privacy legislation is the Privacy Bill of Rights Act (S 1214). One of two bills sponsored by Sen. Edward Markey (D-Massachusetts), the Act seeks to “establish and protect individual and collective privacy rights.” Its definition of personal information includes both historical and real-time geolocation data as well the data and ID numbers people generate as they go through life. This includes the data they generate as they use the web as well as their personal characteristics such as face geometry and finger prints and even their “visual, thermal, olfactory, or similar information.”
The bill requires an entity that gathers personal information to collect only the data that is required to provide the service they’re offering. They must also protect the data they collect and enable it to be assessed, corrected and deleted.
Organizations will not be allowed to use take-it-or-leave-it tactics where customers must agree to give up their data to be able to use a service. Entities also cannot pay people to allow data on them to be collected and they cannot re-identify data that has been anonymized. To enforce these mandates the bill creates a right of action enabling individuals who have been impacted by violations of the bill’s provisions to sue in civil court for actual and punitive damages.
Markey’s other bill would amend the existing Children’s Online Privacy Protection Act of 1998 to strengthen protections relating to the online collection, use, and disclosure of personal information of children and minors. Among other provisions it would add geolocation to the definition of personal information.
Senator and presidential candidate Amy Klobuchar (D-Minnesota) sponsored the less ambitious Social Media Privacy Protection and Consumer Rights Act of 2019 (S 189). This legislation, which has three co-sponsors, is mostly about disclosure. Those providing services have to be up front about the data they collect and have terms of service statements describing their use of personal data that are clear, concise, accessible, of reasonable length and clearly distinguishable from other matters. The company collecting the data would be required to protect it but if a user does not want to provide data they can be denied service. Klobuchar’s bill gives enforcement power to the Federal Trade Commission and the state governments. Interestingly the bill defines geolocation data — which is considered to be personal information — as information generated by, or derived from, the operation of a device that can be used to determine or even infer the location of an individual.
