(photo: @Uber)
The e-receipt from your last Uber ride isn't the only record of your trip. The base that dispatched your car records a "what, when, and where" of your journey, and that information is available to the Taxi and Limousine Commission (TLC) upon request.
Soon, if the TLC's proposed rules are approved on Thursday, November 20, the agency will start storing that data on its servers and require bases to report regularly in a more efficient standardized format. As might be expected, the proposed rule change is letting an old simmering fight boil over: self-professed protectors of the free market, like Uber, are raising privacy concerns. But if Uber's comments at the TLC's October hearing are any indication, the for-hire car company is using privacy as a pretext for protecting its business interests. That makes me skeptical.
Uber is trying to vilify all data gathering when what it really wants to do is keep secret its market share. Data analysis is not inherently a bad thing, especially when accompanied by transparency, regulation, and indicia of trust.
It's hard to argue, as Uber has, that the change will intrude into driver privacy in the traditional sense. Except for identifying the car's home and dispatching bases, the information is already being recorded and required of all licensed for-hire cars in New York City. Plus, the TLC isn't interested in sensitive information about drivers, customers, or for-hire car companies. It isn't even asking for drop-off data, just pick up, base, and license information. And, in any event, the TLC gathers much more detailed information from yellow and green cabs.
But the rule may raise a different kind of privacy concern (and here, I'm relying on the work of privacy scholars like Helen Nissenbaum at NYU and Dan Solove at George Washington University Law School). Let's call it an accessibility problem. There's a big difference between, on the one hand, data being stored in fifty different dusty file cabinets at fifty different bases and, on the other hand, that same information being gathered together into one Excel spreadsheet and accessible on a government server.
I'm not referring to the statistically insignificant likelihood of a leak; any such concern is highly exaggerated. Rather, it's about access and the ease of analysis, aggregation, and (mis)categorization.
That is, admittedly, a very real concern. Recently, in the New York Times, Maryland Law Professor Frank Pasquale warned that an entire industry of data miners is pulling the floor out from under us as it skates by in the dark corners of the unregulated internet. He reminded us that real people can face real harms when sensitive information like prescription drug or medical histories gets tossed into the heap of a Kafka-esque "big data" regime.
But those real dangers are just not applicable here, and it is disingenuous for a company like Uber, which admitted at the TLC's October meeting that it was chiefly concerned with keeping secret its market share data, to turn all information gathering techniques into automatic evils.
Trip data is not as sensitive as, say, a list of prescription drugs we take. Nor is it anything like our telephone call history or our Facebook passwords. The TLC's requested information is sufficiently general so as to make it inordinately difficult, if not impossible, to find out who drove whom where and for how much. Drop-off and fare data, again, are not included.
Plus, this data could provide all sorts of benefits for the TLC and for New York City: from making it easier to keep customers safe, identify dangerous drivers, and investigate customer complaints, to helping determine which City neighborhoods are underserved by for-hire cars, assess the continued value of old laws in a world with a vibrant for-hire market, and evaluate new TLC programs, to name just a few. Data can be a wonderful tool, if used appropriately.
The question then is not whether this data collection should happen at all; rather, it is how it happens. We want information gathering to happen in a manner that protects our interest in privacy, inspires public trust, and serves the TLC's mission and the general welfare.
To those ends, the TLC should continuously fine-tune its protocols to ensure that it is a trusted guardian of trip data. And it is doing just that. It has narrowly tailored the rule to provide it with the minimum amount of data necessary to achieve its public safety goals. The TLC has appropriately balanced privacy interests with its other obligations by limiting what could be released under a Freedom of Information Law (FOIL) request. It has developed internal protocols to keep trip data secure so that only employees who need access to these data to do their jobs would have the login and password to access the data. And it is approaching this policy change by being transparent about what is being requested, how it is being stored, and what could be released.
Privacy interests are fundamental to who we are as a society, and governments need to take them seriously by seeing themselves as stewards of our information. But data collection can open doors: it can help us create a more intelligent, more efficient, more just society. It will take a public-private partnership to do that. Manipulating the public by waving the privacy flag, however, is not good corporate citizenship.
***
Ari Ezra Waldman is Associate Professor of Law and Director of the Institute for Information Law and Policy at New York Law School. You can follow him on Twitter at @ariezrawaldman
