Is scooter data too personal to track?
The abrupt arrival of thousands of electric scooters in Los Angeles last year has already forced public, sometimes ugly, disagreements about how the city’s street and sidewalk space should be used.
Now, Los Angeles’ launching of a one-year program legalizing the vehicles has made them the focus of a fight about data privacy.
Under new city rules, every company with a permit to rent out scooters or shared bicycles must send data to transportation officials on every trip the vehicles make.
That location data will help the city determine which companies are flouting new operating rules that cap the number of vehicles and restrict where they can be parked, officials said.
Tracking them electronically will also be faster and cheaper than paying employees to look for rogue vehicles blocking sidewalks or wheelchair ramps.
“The public has to be reassured that there is somebody who is keeping a close eye,” said Seleta Reynolds, the Transportation Department’s general manager, who is overseeing the initia-
tive.
The problem, opponents say, is that Los Angeles wants to keep too close an eye.
Uber, which operates Jump scooters, and several data privacy organizations have said the city’s policy constitutes government surveillance and would yield far more information about bicyclists and scooter riders than is available on drivers or transit commuters.
Many scooter trips in Los Angeles are tourist joyrides, but public officials say the zippy electric devices could become a meaningful transportation alternative that helps commuters get to transit stops and run errands without driving.
The city will require companies to share information on the start point, end point and travel time of each bike or scooter trip within 24 hours after it ends, and whether the vehicle entered zones where riding or parking are restricted.
The data would not include a rider’s name, but even in sprawling metropolitan areas, paths between home, work and school are typically unique, experts say. Someone with basic coding skills and access to the data could easily connect a trip to an individual person.
“This data is incredibly, incredibly sensitive,” said Jeremy Gillula, the technology projects director for the Electronic Frontier Foundation, a San Francisco digital rights group.
The vast trove of information could reveal many personal details of regular riders — such as whom they’re dating or where they worship — and could be misused if it fell into the wrong hands, the nonprofit Center for Democracy and Technology told the city in a letter.
The New York Times recently analyzed a database containing the movements of more than 1 million cellphones and easily identified individual people, including an aide to New York Mayor Bill DeBlasio and a middleschool teacher whose phone reported her home address, her workplace and the location of her Weight Watchers meetings.
The scooter and bicycle data will be classified as sensitive and confidential, which means information on individual rides will not be published on the city’s open data website or subject to public records requests, Reynolds said.
The data would be provided to police with a warrant and could be revealed in response to a subpoena, the city said.
Some form of the data will also be shared with other city agencies “at the level of aggregation that we think they need,” Reynolds said, including city planners and the sanitation workers tasked with removing scooters from sidewalks, wheelchair ramps and other rights of way.
Uber spokesman Davis White said the city has not answered “fundamental questions” about how the it will safeguard the data. Uber is willing to share some data with L.A., he said, “so long as user privacy is protected.”
The city has urged California regulators to adopt a similar model for trips made in Uber and Lyft cars, which would reveal vast amounts of information on the companies’ operations statewide — data that cities badly want to review but that the companies have jealously guarded.
The dispute highlights the lack of trust between cities and transportation companies that have typically moved into new markets without asking permission, working with local officials or sharing details on their operations.
“I would trust Uber as far as I could throw one of their cars, and you can quote me on that,” Gillula said. But that doesn’t mean their concerns are without merit, he added.
The city plans to require companies to submit ride data starting April 15.
Uber is pushing for a model that would require the companies to share lessdetailed information and has urged the Transportation Department to submit the plan to the City Council for debate.
Allowing companies to summarize their own data is akin to “letting the fox watch the henhouse,” Reynolds said, adding that she is “somewhat skeptical” that the companies would provide accurate information on their own.
Uber infamously used a program called Greyball that served up a fake version of the ride-hailing app to regulatory officials to stymie enforcement efforts.
Seattle, which had an early study of bike-share data, found that the companies’ self-reported information had a “high margin of error,” Reynolds said.
Aggregated data could also pose problems for L.A.’s pilot program, which caps companies at 3,000 scooters or bikes citywide but offers a bonus of up to 7,500 more if they are deployed in low-income neighborhoods, she said. Tracking that compliance will require granular data that is “defensible and credible.”
“None of the things they’ve outlined in terms of transportation planning or enforcement or oversight requires keeping a record of where everyone has traveled,” said Kevin Webb, codirector of Shared Streets, a nonprofit organization that helps cities and companies share transportation data and has accepted funding from Uber and Lyft.
One option, he said, would be to create a confidential database in which trip data could be stored and stripped of some identifying information before being sent to the city.
The database would record who shared the data and what information was shared, creating a log that could be audited.
“The city is framing this as a debate with the companies,” Webb said.
“But really, it’s between the city and all the citizens who are customers whose data and lives are being swept up in this fight.”