After a jolly festive period (considerably warmer, I'm led to understand, for me in Palo Alto than for my colleagues in the UK), the New Year is upon us and privacy professionals everywhere will no
After a jolly festive period (considerably warmer, I'm led to understand, for me in Palo Alto than for my colleagues in the UK), the New Year is upon us and privacy professionals everywhere will no doubt be turning their minds to what 2013 has in store for them. Certainly, there's plenty of developments to keep abreast of, ranging from the ongoing EU regulatory reform process through to the recent formal recognition of Binding Corporate Rules for processors. My partner, Eduardo Ustaran, has posted an excellent blog outlining his predictions here.
But one safe bet for greater regulatory attention this year is mobile apps and platforms. Indeed, with all the excitement surrounding cookie consent and EU regulatory reform, mobile has remained largely overlooked by EU data protection authorities to date. Sure, we've had the Article 29 Working Party opine on geolocation services and on facial recognition in mobile services. The Norwegian Data Protection Inspectorate even published a report on mobile apps in 2011 ("What does your app know about you?"). But really, that's been about it. Pretty uninspiring, not to mention surprising, when consumers are fast abandoning their creaky old desktop machines and accessing online services through shiny new smartphones and tablets: Forbes even reports that mobile access now accounts for 43% of total minutes spent on Facebook by its users.
Migration from traditional computing platforms to mobile computing is not, in and of itself, enough to guarantee regulator interest. But there are plenty of other reasons to believe that mobile apps and platforms will come under increased scrutiny this year:
1. First, meaningful regulatory guidance is long overdue. Mobiles are inherently more privacy invasive than any other computing platform. We entrust more data to our mobile devices (in my case, my photos, address books, social networking, banking and shopping account details, geolocation patterns, and private correspondence) than any other platform and generally with far less security - that 4 digit PIN really doesn't pass muster. We download apps from third parties we've often scarcely ever heard of, with no idea as to what information they're going to collect or how they're going to use it, and grant them all manner of permissions without even thinking - why, exactly, does that flashlight app need to know details of my real-time location? Yet despite the huge potential for privacy invasion, there persists a broad lack of understanding as to who is accountable for compliance failures (the app store, the platform provider, the network provider or the app developer) and what measures they should be implementing to avoid privacy breaches in the first place. This uncertainty and confusion makes regulatory involvement inevitable.
2. Second, regulators are already beginning to get active in the mobile space - if this were not the case, the point above would otherwise be pure speculation. It's not, though. On my side of the Pond, we've recently seen the California Attorney General file suit against Delta Air Lines for its failure to include a privacy policy within its mobile app (this action itself following letters sent by the AG to multiple app providers warning them to get their acts together). Then, a few days later, the FTC launched a report on children's data collection through mobile apps, in which it indicated that it was launching multiple investigations into potential violations of the Children's Online Privacy Protection Act (COPPA) and the FTC Act's unfair and deceptive practices regime. The writing is on the wall, and it's likely EU regulators will begin following the FTC's lead.
3. Third, the Article 29 Working Party intends to do just that. In a press release in October, the Working Party announced that "Considering the rapid increase in the use of smartphones, the amount of downloaded apps worldwide and the existence of many small-sized app-developers, the Working Party... [will] publish guidance on mobile apps... early next year." So guidance is coming and, bearing in mind that the Article 29 Working Party is made up of representatives from national EU data protection authorities, it's safe to say that mobile privacy is riding high on the EU regulatory agenda.
In 2010, the Wall Street Journal reported: "An examination of 101 popular smartphone "apps"—games and other software applications for iPhone and Android phones—showed that 56 transmitted the phone's unique device ID to other companies without users' awareness or consent. Forty-seven apps transmitted the phone's location in some way. Five sent age, gender and other personal details to outsiders... Many apps don't offer even a basic form of consumer protection: written privacy policies. Forty-five of the 101 apps didn't provide privacy policies on their websites or inside the apps at the time of testing." Since then, there hasn't been a great deal of improvement. My money's on 2013 being the year that this will change.
But one safe bet for greater regulatory attention this year is mobile apps and platforms. Indeed, with all the excitement surrounding cookie consent and EU regulatory reform, mobile has remained largely overlooked by EU data protection authorities to date. Sure, we've had the Article 29 Working Party opine on geolocation services and on facial recognition in mobile services. The Norwegian Data Protection Inspectorate even published a report on mobile apps in 2011 ("What does your app know about you?"). But really, that's been about it. Pretty uninspiring, not to mention surprising, when consumers are fast abandoning their creaky old desktop machines and accessing online services through shiny new smartphones and tablets: Forbes even reports that mobile access now accounts for 43% of total minutes spent on Facebook by its users.
Migration from traditional computing platforms to mobile computing is not, in and of itself, enough to guarantee regulator interest. But there are plenty of other reasons to believe that mobile apps and platforms will come under increased scrutiny this year:
1. First, meaningful regulatory guidance is long overdue. Mobiles are inherently more privacy invasive than any other computing platform. We entrust more data to our mobile devices (in my case, my photos, address books, social networking, banking and shopping account details, geolocation patterns, and private correspondence) than any other platform and generally with far less security - that 4 digit PIN really doesn't pass muster. We download apps from third parties we've often scarcely ever heard of, with no idea as to what information they're going to collect or how they're going to use it, and grant them all manner of permissions without even thinking - why, exactly, does that flashlight app need to know details of my real-time location? Yet despite the huge potential for privacy invasion, there persists a broad lack of understanding as to who is accountable for compliance failures (the app store, the platform provider, the network provider or the app developer) and what measures they should be implementing to avoid privacy breaches in the first place. This uncertainty and confusion makes regulatory involvement inevitable.
2. Second, regulators are already beginning to get active in the mobile space - if this were not the case, the point above would otherwise be pure speculation. It's not, though. On my side of the Pond, we've recently seen the California Attorney General file suit against Delta Air Lines for its failure to include a privacy policy within its mobile app (this action itself following letters sent by the AG to multiple app providers warning them to get their acts together). Then, a few days later, the FTC launched a report on children's data collection through mobile apps, in which it indicated that it was launching multiple investigations into potential violations of the Children's Online Privacy Protection Act (COPPA) and the FTC Act's unfair and deceptive practices regime. The writing is on the wall, and it's likely EU regulators will begin following the FTC's lead.
3. Third, the Article 29 Working Party intends to do just that. In a press release in October, the Working Party announced that "Considering the rapid increase in the use of smartphones, the amount of downloaded apps worldwide and the existence of many small-sized app-developers, the Working Party... [will] publish guidance on mobile apps... early next year." So guidance is coming and, bearing in mind that the Article 29 Working Party is made up of representatives from national EU data protection authorities, it's safe to say that mobile privacy is riding high on the EU regulatory agenda.
In 2010, the Wall Street Journal reported: "An examination of 101 popular smartphone "apps"—games and other software applications for iPhone and Android phones—showed that 56 transmitted the phone's unique device ID to other companies without users' awareness or consent. Forty-seven apps transmitted the phone's location in some way. Five sent age, gender and other personal details to outsiders... Many apps don't offer even a basic form of consumer protection: written privacy policies. Forty-five of the 101 apps didn't provide privacy policies on their websites or inside the apps at the time of testing." Since then, there hasn't been a great deal of improvement. My money's on 2013 being the year that this will change.