Is there a regulatory framework for location data?

Analysing location data can help service providers assess whether to boost services in one part of a city versus another, at a particular time of day or in preparation for an upcoming festival, for instance. However, the data used for these analyses is linked to individuals and makes it possible to identify them. City planners and business managers working to improve our ever-changing environment must incorporate the rules for privacy protection into their activities. But what are these rules?

At the Transportation Cybersecurity and Functional Safety Forum, one of the panels was entitled “Data protection for collaborative innovation in mobility.” A key topic of discussion was whether there was a law (or laws) governing this area. The answer is ‘Yes’.

Whether one thinks of information showing the times of use of a bicycle or a car; the route taken from point A to B in the morning and vice versa in the evening; or even information that allows one to locate individuals and inform them about the closest bus or metro lines, all this information is personal.

Information collected by fobs (for those who still have a BIXI fob, for example), mobile apps or RFID tags, like those used in bike or car-sharing services, is linked to individuals and makes it possible to identify them, directly or indirectly. Such devices are often associated with a surname, first name, date of birth, mailing and e-mail addresses, as well as a credit card number.

In Quebec, if a public body—such as a city—or a business wants to collect such information to develop an urban plan or enhance a service offering, it must take into account the laws governing the protection of personal information.

The focus here will be on the Act respecting access to documents held by public bodies and the protection of personal information (public sector) and the Act respecting the protection of personal information in the private sector. Even though, at the time of writing, Bill 64, which aims to modernize these laws, is still under consideration, it is nonetheless possible to identify a few key elements to guide those who collect, use/analyze, distribute and retain such information.

Before collecting personal information or acquiring, developing or redesigning an information system or digital services operation, public bodies and businesses must:

In addition, public bodies and businesses must:

As mentioned in the introduction, there are indeed laws governing the processing of location data. These laws are under review and provide for new obligations for public bodies and businesses.

Even if these obligations are not yet in force, it is advisable to consider them in order to anticipate the issues that could arise with regard to the collection, use, distribution and retention of personal information, especially since the future penalties for non-compliance will be higher than at present.

If you have any questions about this topic, please feel free to contact us.