Wednesday, 9 May 2018

Is Telstra selling customer location data? Did it ever specifically request permission from account holders?

Telstra is making money by on-selling location data from its customers' mobile phones in similar deals to a partnership with the Bureau of Statistics that caused a public backlash last week.

The Australian Bureau of Statistics came under fire for partnering with the telco for a study in 2016, which used mobile phone data showing how many people were in particular suburbs hour by hour.

Similar data is now available for a fee, after the Location Insights program was quietly launched by the telco in July 2016. The Australian Bureau of Statistics was the first licensee under the program, but has not used Telstra's Location Insights since then.
Data available to Telstra's clients can be broken down into 15 minute increments, and demographics broken down by age groups and gender. The smallest geographic areas available for analysis are the same as the Australian Bureau of Statistics' smallest statistical area, which have an average population of 400 people and could have as few as 200 people.

In a video used to spruik the service by Telstra, potential customers are listed as local governments and transport companies. It’s not clear how many organisations have used the service, or what the price tag is for such information.

“Imagine if you could know what is happening in your community, region, or city hub, every 15 minutes,” a voiceover in the Youtube video promoting the program said.
“Telstra Location Insights builds industry-specific metrics where data sets are used for modelling purposes and then extrapolated to estimate for the entire population,” a Telstra spokesman said.

“These metrics are aggregated spatially and temporally before differential privacy and k-anonymisation are both applied to completely anonymise the data.”

This explanation is not accepted by senior lecturer at the University of Melbourne Vanessa Teague.

“In order to know whether those things actually work, we need to see what the parameters are and how they're applied to the data in order to be assured that they’re applied correctly and they work,” Dr Teague said.

Dr Teague is chair of the Cybersecurity and Democracy Network and was part of a team of researchers who re-identified patient health records from Pharmaceutical Benefits Scheme data that was released by the government.

“It's possible that [anonymising the data] has been done correctly, it's also possible that they think it’s been done correctly but they’re wrong. And really the only way to assess that is to get a clear and detailed technical description of what they've done,” Dr Teague said.

“If they've done it right then there's no reason to be secretive about the details of what they’ve done, if they’ve done it wrong then they are better off getting a genuine open assessment of it so they can find out sooner rather than later.”

Telstra said the use of the information was in line with its privacy statement, which states that customers’ information could be shared with “our dealers, our related entities or our business or commercial partners and other businesses we work with”.

Dr Teague is sceptical about that explanation. “Just because a company holds highly sensitive information about you doesn’t mean that that data is their property that they should then be able to turnaround and sell without asking you,” she said.

Now when I read Telstra's privacy statement I do not recall that it mentioned that it would be selling mobile phone location information in SA1 statistical level data bundles captured at 15 minute intervals (as mentioned in the news article) and, that those bundles could be used to create data sets which track an individual's movements over time in relatively fine detail.

Yamba in the Clarence Valley NSW is a quiet little town with a population of approx. 6,076 persons living in 3,820 dwellings spread across est. 16 SLA1 statistical levels and in over 100 even smaller statistical Mesh Blocks.

I suspect that many Yamba residents will not be happy with the idea that Telstra Corporation Limited will alllow their movements to be tracked and their daily habits predicted if an individual, private company, government agency or political party pays them for the town's mobile phone location data.

No comments: