Privacy groups actually side with Uber in scooter data fight

In Los Angeles, a battle's been slowly brewing between scooter-shares and the transportation department. Now, privacy organizations are taking sides.

Scooter companies like the Uber-owned Jump are not having it with the Los Angeles Department of Transportation (LADOT) data-gathering policies required for operating a scooter company in the city. Back in March, LADOT gave year-long permits to Bird, Lyft, Lime, Bolt, Sherpa, Spin, and Wheels to offer app-based rides on two-wheeled electric vehicles. Uber's Jump was given a temporary permit.

Uber (and to its credit, Lyft) balked at parts of the permit about data policies. LADOT wanted real-time data as part of its Mobility Data Specification (MDS) system to collect data from the companies, as it was mandated that they "provide real-time information about how many of their vehicles are in use at any given time." Uber was down to give data about its scooters like it does in other cities like Oakland and Seattle, just not the way LADOT was demanding it.

Earlier this year, the digital rights group Electronic Frontier Foundation (EFF) wrote to the LA city council, concerned about risking customers' private information. Lyft sent a letter in April outlining three main issues with the data program. First, the letter discussed sharing customers’ highly granular origin and destination data in real time and their complete route data at the end of their trip.

It also raised concerns with using a third-party to store data which Lyft considered "insufficient safeguards to secure our customers’ information from breach, abuse, and disclosure." Finally, it noted that LADOT "provided no justification for requiring, collecting, and storing detailed records of every scooter trip." Uber's issues lined up similarly and the company held fast to their objections.

Fast-forward to the end of October, and Uber is threatening to sue the LADOT over the data policy it's still enforcing for scooter-sharing. Meanwhile, LADOT is threatening to suspend Jump's permit unless the company complies like the other scooter operators have since done.

In a statement on Tuesday, an LADOT spokesperson wrote "To be effective, the department requires reasonable information about the tens of thousands of shared vehicles operated by transportation technology companies that use our streets for profit."

They went on, "While all other permitted scooter and bike companies are complying with our rules -- Uber has repeatedly refused. LA’s requirements have been clear since last November, and Uber agreed to abide by them. By 5 pm Tuesday, we expect Uber to come into compliance or they will face suspension proceedings, which could eventually lead to revocation of their permit.”  

Uber shared its own statement on Tuesday: "Jump riders in Los Angeles have a reasonable expectation of privacy in the trip data created from riding on our bikes and scooters. Independent privacy experts have clearly and repeatedly asserted that a customer’s geolocation is personally identifiable information, and - consistent with a recent legal opinion by the California legislative counsel - we believe that LADOT's requirements to share sensitive on-trip data compromises our customers' expectations of data privacy and security."

In the intervening months, the EFF's stance hasn't changed. In fact, the group is standing by Uber's steadfast resistance to what it considers a weak, dangerous, and in some ways illegal data policy — even if it sounds funny for a tech privacy organization to support a company like Uber. But as EFF staff attorney Camille Fischer noted in a Tuesday phone call, "This program is collecting far too much information." She said the EFF agrees with Uber that "anonymized, aggregated data could be really useful for the city," but the way the LADOT is going out about it is "kind of terrifying."

Before permits were even issued last November, the tech advocacy group Center for Democracy & Technology put out a statement of concern with LADOT's plan for collecting sensitive personal data from riders. That concern hasn't wavered since and the group is defending Uber's position on data collection in LA.

Uber submitted a letter Monday to the department after the LADOT informed them about their "non-compliance" on Friday. The letter stated, "We believe that best in class data aggregation methods could deliver LADOT near-real time data - while protecting the identity of Los Angeles residents and our riders." Uber has been giving LADOT data reports with a 24-hour latency, not in real-time as the permit program stipulates.

It hasn't come to courtroom blows yet, but Uber is ready to sue the city to defend its data privacy position. Stay tuned.

UPDATE: Oct. 31, 2019, 12:55 p.m. PDT Uber's Jump scooter permit was suspended for 10 days starting Wednesday. The company refused to comply with LADOT's requirements by the department's Tuesday evening deadline.

The Wall Street Journal reports that if Uber doesn't meet or request a meeting with LADOT officials before the end of the suspension period its license could be pulled. At that point all its scooters would have to be removed from city streets.

Uber has yet to formally file suit against the city, but is prepared to do so.