Who: City of London Corporation, Renew London (Renew), Information Commissioner’s Office (ICO)
When: 12 August 2013
Where: London
Law stated as at: 4 September 2013
What happened:
The City of London Corporation has ordered Renew, the provider of recycling bins in London which contain an LCD advertising screen, known as ‘smart’ bins, to stop collecting data from the mobile devices of individuals passing by the bins.
Since the lead-up to the 2012 London Olympics, Renew has rolled out 200 hi-tech recycling bins in East London which display a screen on which advertisers can pay to deliver their ads through the bins’ internet connectivity. At present, although local councils and charities receive up to a third of the screen time on the smart bins, the running costs are covered by the purchase of the remaining advertising time by marketers.
Of the 200 bins, 12 in the Cheapside area of London have been fitted with Renew’s trial technology which detects signals from passing smartphones when their Wi-Fi is switched on. Using this data in aggregated form, Renew can provide paying advertisers with useful information about passer-by trends.
Big brother bins?
According to online magazine Quartz, the trial bins are designed to gather data without the need for permission. This is done by logging the media access control (MAC) address – a unique identification code found on all devices capable of connecting to a Wi-Fi network – of individual smartphones in the immediate area. A statement by Renew’s Chief Executive, Kaveh Memari, explained that the bins had only recorded “extremely limited, encrypted, aggregated and anonymised data” and that they were effectively “glorified people-counters in the street”. Allegedly, the form of the trial meant that, much like a website counting the hits it has had, the smart bins could track the number of passing visitors. However, Renew has stressed that no personal information relating to individual smartphone owners was processed or held by the company.
Nevertheless, the fact that the bins can detect the speed and location of those walking past will allow scope for personalised advertising to be displayed based on people’s behaviour. In theory, as the bins detect that a person or group of people tend to walk past a specific side street at lunchtime, Renew can feed this information back to a restaurant chain who could then advertise special offers or remind people of its loyalty programs at certain times in an attempt to direct people towards its business. Where people shop may also be recorded, and the technology will have the capability to measure new devices entering a venue and the route that they have taken to get there. Additionally, it has been reported that the trackers may eventually be implemented so as to deduce gender, for instance by working out which phones are in which bathrooms, so that advertising on the bins in the area can be manipulated accordingly.
Legal grey area
Whilst there are strict legal obligations on websites in Europe to inform users that they are tracking the individual’s internet use in the form of cookies, the regulation of other devices is slightly less clear-cut. As the process of tracking MAC codes does not leave any trace on the device in question, and instead only requires the logging of a successful Wi-Fi connection when the device is in the vicinity, the law on cookies can be bypassed.
However, objections have been brought against this logic. A 2011 opinion from the EU’s Article 29 Working Party stated that “the combination of the unique MAC address and the calculated location of a Wi-Fi access point should be treated as personal data”. Those individuals or bodies who are concerned about an invasion of privacy by Renew, such as campaign group Big Brother Watch, support this stance and believe that, in order to collect the type of data being gathered by the bins in question, the permission of the device owner should be required in the same way that it is for the dropping of cookies.
Why it matters:
As it stands, the City of London Corporation has ordered Renew to stop the collection of data by the offending bins and has referred the case to the ICO. Despite proclaiming that it is not an issue worthy of complaint and that the tracking is not in breach of law, Renew has currently suspended its trials.
Although the general legal consensus is that MAC data sold to advertisers in a raw, anonymised form does not contradict data protection legislation in its current form, the sheer number of unknown factors has meant that the ICO will need to look into the technology in more detail before it can substantively comment. All it has said so far is that “any technology that involves the processing of personal information must comply with the Data Protection Act” and that it will be “making inquiries to establish what action, if any, is required.”
Given that the tracking has the potential to affect large groups of people, with a whopping 4,009,676 devices having been captured in a week during Renew’s trial, it is an issue that has the capacity to cause a large public stir. As a result of this pressure, it is likely that the concept of MAC tracking could become an important issue for the ICO to consider in the context of data protection. Watch this space.
