Cashing in on Your Mobile?
Total Page:16
File Type:pdf, Size:1020Kb
Cashing in on your mobile? How phone companies are exploiting their customers’ data Open Rights Group (ORG) is the UK’s only grassroots campaigning organisation that works to protect your digital rights. We believe people have the right to control their technology, and oppose the use of technology to control people. We raise awareness of threats to privacy and free speech and challenge them through public campaigns, legal actions, policy interventions and tech projects. Research and lead writer: Javier Ruiz Editors: Pam Cowburn, Jim Killock Additional research: Alexandra Stefano, Ed Johnson-Williams, Ruth Coustick-Deal Design: Avances Comunicación Visual - www.avances.es All ORG materials, unless otherwise specified, are published under the Creative Commons Attribution-Share Alike 3.0 Unported license. The Open Rights Group reserves all rights to our logos. These are not published under a Creative Commons licence however we are happy to discuss reuse on a case-by-case basis. Please contact us if you wish to reuse our logos. Cover photo credit Pexels.com Creative Commons Zero (CC0) Open Rights Group www.openrightsgroup.org +44 20 7096 1079 Open Rights is a non-profit Company Limited by Guarantee, registered in England and Wales no. 05581537 TABLE OF CONTENTS Chapter 1. Introduction ................................................................5 About this report .........................................................5 Summary of our findings ..................................................6 Our recommendations ....................................................7 Consent. 7 Anonymisation .........................................................7 Transparency ..........................................................7 Regulation .............................................................7 Legal reforms: review of the EU E-privacy Directive .........................8 Chapter 2: Big data goes mobile .......................................................10 How do mobile devices collect our data? ..................................10 How data is used ..........................................................10 What do customers think? .................................................13 Regulation of data collected by apps ......................................13 What kind of data is used in mobile analytics ..............................13 Personal information ...................................................13 Traffic data .............................................................13 Location Data ..........................................................13 Determining whether data is traffic or location data ........................14 What are the benefits for customers? ......................................14 Chapter 3: What UK mobile companies are doing .....................................15 Everything Everywhere (EE) ...............................................15 Telefónica ................................................................17 Vodafone .................................................................19 Three UK .................................................................20 Chapter 4: Consent and opt outs .......................................................22 The legal obligation for consent ..........................................22 EE Consent .............................................................23 O2 Consent ............................................................23 Vodafone Consent .....................................................24 Opting out of traffic data ..................................................24 Opting out of location data. 25 General marketing opt-outs should be easier ..............................26 The American system of opt outs. .26 Recommendations .......................................................26 Chapter 5: Anonymous data ...........................................................28 EE Anonymisation ......................................................28 O2 Anonymisation .....................................................29 Vodafone Anonymisation ...............................................30 Bypassing consent through anonymisation ................................30 It is difficult to anonymise rich datasets ....................................30 It is very difficult to anonymise location data ...............................31 Companies create pseudonymous profiles before they anonymise data .....31 The role of the Information Commissioner’s Office .........................32 Chapter 6: Transparency ...............................................................33 Privacy policies are not detailed enough ...................................33 Inconsistencies between privacy policies and actual practices .............33 Personal data access requests should be easier. 34 Customers can’t see contracts until they have a credit check ................34 Data sharing with third parties ............................................35 Reuse of billing data ......................................................35 Conclusion .............................................................37 Appendix 1: Legislation for the use of mobile data .......................38 Regulation of traffic data ..................................................38 Regulation of location data ................................................39 National security and emergencies ........................................39 Appendix 2: Privacy policies ............................................40 Open Rights Group (ORG) CHAPTER 1. It is estimated that by 2016 UK mobile operators could be making over half a billion pounds a year just from monetising the INTRODUCTION location of their customers3. Companies need to collect and keep data so that they can bill us for our services. But just because they collect this data, does not mean that they have an automatic right to process The mobile phone market industry in the that data for other purposes without our UK is worth £14 billion1, with 93% of adults consent. owning a mobile phone, and 61% owning a smartphone2. Within this multi-billion pound ORG believes that people have the right to industry, there is a fast-growing market in control how their data is used. If a company services and products created from the data wants to collect and use our data, they that customers generate when we use our should tell us why and ask for our explicit phones. permission. If they don’t, they are removing our right to control this data and the risks After we buy a phone, we hand over personal associated with their use of it. They must also information to our mobile phone providers treat this data with care and make sure that on a daily basis. From our customer profiles, it cannot be used to identify us or reveal our companies already know our name, address, personal information to anyone else. Both of age, gender and employment status. But from these are vital for maintaining trust between our phone use, they can get a real insight into customers and companies. In addition, the our behaviour — such as, who we call and text, law must be adequate to allow individuals to when we contact them and how frequently. fully understand and control what happens to Importantly, they can tell your location their personal information in the new Big Data throughout the day from the phone masts world. connected to your handset. If you have a smartphone, your mobile provider will also have information about your About this report Internet use. In this report, we examine whether mobile By analysing this data, mobile phone phone users are being given enough companies can find patterns and insights into information to make informed choices about customers’ behaviour. There is now a rapidly- how their data is used. growing industry in ‘secondary products’ We have looked at the policies and contracts based on mobile data analytics. These include of the UK’s four main mobile providers: EE, O2, services such as real-time traffic reports or Vodafone and Three UK, and analysed what marketing products, for example tools that information they gather, store, analyse and could tell website owners how many people share. We also had several meetings and direct are looking at their websites in a particular conversations with representatives from these geographic location. companies as well as officials from the ICO. 1 Information Communications Technology (ICT) in the UK: investment ORG’s supporters contacted their providers opportunities (Feb 2014) https://www.gov.uk/government/ about these practices and requested a copy of publications/information-communications-technology-ict-in-the-uk- the data held about them, which we checked investment-opportunities/information-communications-technology- against each company’s privacy policy. Finally, ict-in-the-uk-investment-opportunities 2 Ofcom Communications Market Report 2014 http://media.ofcom.org. 3 http://www.telco2research.com/articles/WP_telco2-making-money- uk/facts/ — 2014, Q1) from-location-insights 5 How phone companies are exploiting their customers’ data we carried out mystery shopper visits to the Such convergence of data sources and the companies’ front end shops in the high street tracking of consumers across multiple devices to ask about personal data handling. is a growing concern. The information in this report is based on the information available to us. We welcome feedback and are happy to update this briefing According to research by the mobile if any of the companies mentioned believe industry association