Mobile Commerce

By Alan Gahtan - June 25, 2001

In her 2000 Annual Report, Ontario’s Information and Privacy Commissioner (IPC) expresses concern about the threats to privacy that wireless technology can introduce.  According to Ann Cavoukian, “if not implemented with an upfront commitment to privacy - through legislated protections and embedded in the design of the technology itself - wireless technology may pose significant challenges to privacy.”

Of particular concern is advanced GPS and radio direction-finding technology which is expected to be incorporated into cell phones in the near future.  Such technology will be required in order to comply with the E911 initiative which goes into effect in the United States later this year.  When a person dials 911 from a cell phone in the U.S., the emergency services will be able to locate the phone to within 20 meters. 

Of course, other non-emergency uses will also be possible.  For example, parents may be able to track their children’s whereabouts.  Also, businesses may be able to send geographically targeted advertisements using SMS messages to cell phones which are nearby.

The IPC cautions that as helpful as these new capabilities are, we must approach them with caution, as location-tracking information - when combined with a date and time stamp - can have serious privacy implications.  For example, governments need only make a small technical leap to use the locational capabilities of cell phones to track all drivers in order to ticket speeders, or to review cell phone data trails of everyone who was in a specific area at a specific time to track down both criminals and witnesses to crimes.

Based on existing internationally recognized fair information practices, the IPC suggests a number of privacy goals for wireless technology:

• Restriction of data collection and retention.  This is a fundamental principle of fair information practices and needs to form the basis of any wireless infrastructure. The amount of personal information collected via the Internet may ultimately be dwarfed by what will be collected through wireless technology. Organizations need to introduce strict controls for what is collected and introduce automated purging procedures deleting anything beyond the basic information needed to conduct a particular transaction.
• Provision of encryption.  The user's point of access (cell phone or other personal digital assistant) must start the encryption process. The process needs to be end-to-end in order to be truly effective and should only take place with trusted intermediaries. The question of encryption key management - deciding who should have access to the keys that lock and unlock the data - must also be addressed. From a privacy perspective, it is critical that the encryption keys remain in the hands of consumers.
• Creation of an open platform for wireless devices.  Users should be able to select and activate privacy and security technology that is independent of the particular cell-phone manufacturer or carrier. Currently, there are competing platforms in North America, but none of them allow consumers any choice regarding privacy.
• Use ofoOpen source technology.  All technologies that "touch" a consumer's data must be accessible to public scrutiny. The technology components that comprise the wireless infrastructure, including the encryption systems, the data transport mechanisms, and the systems architecture, should be "open source" to allow for objective expert analysis.
• De-linking transaction data.  The wireless infrastructure needs to ensure that any personally identifiable information is used only for a particular transmission. Location and time data needs to be separated from personally identifiable data.

According to the IPR, “the challenges for privacy protection in a wireless world will only become more significant over time. That makes it critically important that technology designs and standards have privacy protections built into the infrastructure, and that the legislative framework used to regulate the use of wireless technology addresses fundamental privacy issues.”

A full copy of the Report is available at:

http://www.ipc.on.ca/english/pubpres/ann_reps/ar-00/ar-00e.htm

Related Sources: Canadian Legal Resources | Cyberlaw Encyclopedia | Entrepreneur Resources | Canadian Technology | Precedents | Alan Gahtan

© 2005 Alan M. Gahtan. All Rights Reserved | Use is subject to these Legal Terms
Disclaimer: Not all materials may be applicable in your jurisdiction. Not intended to be a substitute for professional advice. No implied endorsement of, or affiliation with, any linked sites. Path to individual pages may change - please link to home page only.   Linking Info