playing fast and loose — How your sensitive data can be sold after a data broker goes bankrupt Sensitive location data could be sold off to the highest bidder.
John Keegan, The Markup – Feb 25, 2024 11:57 am UTC EnlargeMongkol Chuewong, GettyImages reader comments 79
In 2021, a company specializing in collecting and selling location data called Near bragged that it was The Worlds Largest Dataset of Peoples Behavior in the Real-World, with data representing 1.6B people across 44 countries. Last year the company went public with a valuation of $1 billion (via a SPAC). Seven months later it filed for bankruptcy and has agreed to sell the company.
But for the 1.6B people that Near said its data represents, the important question is: What happens to Nears mountain of location data? Any company could gain access to it through purchasing the companys assets.
The prospect of this data, including Nears collection of location data from sensitive locations such as abortion clinics, being sold off in bankruptcy has raised alarms in Congress. Last week, Sen. Ron Wyden (D-Ore.) wrote the Federal Trade Commission (FTC) urging the agency to protect consumers and investors from the outrageous conduct of Near, citing his offices investigation into the India-based company.
Wydens letter also urged the FTC to intervene in Nears bankruptcy proceedings to ensure that all location and device data held by Near about Americans is promptly destroyed and is not sold off, including to another data broker. The FTC took such an action in 2010 to block the use of 11 years worth of subscriber personal data during the bankruptcy proceedings of the XY Magazine, which was oriented to young gay men. The agency requested that the data be destroyed to prevent its misuse.
Wydens investigation was spurred by a May 2023 Wall Street Journal report that Near had licensed location data to the anti-abortion group Veritas Society so it could target ads to visitors of Planned Parenthood clinics and attempt to dissuade women from seeking abortions. Wydens investigation revealed that the groups geofencing campaign focused on 600 Planned Parenthood clinics in 48 states. The Journal also revealed that Near had been selling its location data to the Department of Defense and intelligence agencies. Advertisement
As of publication, Near has not responded to requests for comment.
According to Nears privacy policy, all of the data they have collected can be transferred to the new owners. Under the heading of Who do you share my personal data with? It lists Prospective buyers of our business.
This type of clause is common in privacy policies, and is a regular part of businesses being bought and sold. Where it gets complicated is when the company being sold owns data containing sensitive information.
This week, a new bankruptcy court filing showed that Wydens requests were granted. The order placed restrictions on the use, sale, licensing, or transfer of location data collected from sensitive locations in the US and requires any company that purchases the data to establish a sensitive location data program with detailed policies for such data and ensure ongoing monitoring and compliance, including the creation of a list of sensitive locations such as reproductive health care facilities, doctors offices, houses of worship, mental health care providers, corrections facilities and shelters among others. The order demands that unless consumers have explicitly provided consent, the company must cease any collection, use, or transfer of location data.
In a statement emailed to The Markup, Wyden wrote, I commend the FTC for stepping inat my requestto ensure that this data brokers stockpile of Americans sensitive location data isnt abused, again.
Wyden called for protecting sensitive location data from data brokers, citing the new legal threats to women since the Supreme Courts June 2022 decision to overturn the abortion-rights ruling Roe v. Wade. Wyden wrote, The threat posed by the sale of location data is clear, particularly to women who are seeking reproductive care.
The bankruptcy order also provided a rare glimpse into how data brokers license data to one another. Nears list of contracts included agreements with several location brokers, ad platforms, universities, retailers, and city governments.
It is not clear from the filing if the agreements covered Near data being licensed, Near licensing the data from the companies, or both.
This article was originally published on The Markup and was republished under the Creative Commons Attribution-NonCommercial-NoDerivatives license. reader comments 79 Advertisement Channel Ars Technica ← Previous story Related Stories Today on Ars
