Vodafone and governments claim no personal data was shared
Vodafone has given the federal and New South Wales (NSW) governments data regarding customers’ locations, to help determine whether Australians are abiding by social distancing guidelines. The telco claims the data doesn’t show any individual customer information, but is rather “aggregated network information” that shows the “total number of subscribers in various areas at points in time.”
Despite Vodafone’s assurances that the data only shares aggregated information, there are some privacy questions that must be addressed. Most point to the apparent ability of telcos to collect specific user location information in real time, as well as telcos’ willingness to share user information with government without customer consent.
But the current times may call for less scrutiny for Vodafone’s move. The coronavirus outbreak has been a stubborn one, affecting virtually every part of Australian lives and businesses. To fight it, extreme measures have to be taken, and perhaps we can overlook such measures for that fact alone.
Government’s reliance on technology to fight COVID-19
Vodafone’s user location sharing isn’t the first time the government has used technology data to figure out if social distancing measures are being observed. Transport apps like City Maps have been used by the Australian government to see if movement has reduced by analyzing location data. Google Maps reports also show changes in movements that can be used by governments.
City Maps showed a significant reduction in movement in Sydney throughout the month of March. src
But such apps don’t have enough users to represent the entire country, and that calls the validity of their data into question. A major telco, on the other hand, will show a much more accurate picture of how many Australians are out during the ongoing coronavirus pandemic, compared to before the outbreak.
Vodafone’s 6 million customers show a clearer picture
Vodafone announced last year that its subscriber base had passed the six million mark in 2018. With the Australian population standing at around 25 million, Vodafone’s subscriber base should be quite representative.
As a result, any data showing aggregate information about how many Vodafone customers are out and on the move while current restrictions and guidelines are in place should give a pretty good idea of the country as a whole.
This data would be even stronger if Telstra and Optus joined in. However, neither of those telcos have admitted or denied sharing information with the government. Both of those telcos rely on confidentiality when declining to share or acknowledge any government requests for user information.
Why does the government need customer data?
Many states have restricted Australians’ movements one way or another. For instance, New South Wales has ordered a 90-day lockdown where the police can actually enforce home isolation rules.
These lockdowns and movement restrictions have been put in place in an attempt to slow or stop the spread of COVID-19. But figuring out whether the restrictions are being observed by Australians, or how well they’re being observed, requires some data that can hardly be collected on the ground.
Turning to telcos for this data seems like a great place to start. The vast majority of Australians have mobile phones, and so the major telcos have information on those mobile phone locations.
Analysing such location data tells the government if there has been a decline in movement after movement restriction guidelines and orders went into place, which can help formulate further policies or show a correlation between less movement and less virus infections.
What does the data show?
According to Vodafone and the government, the user location data doesn’t show any personal information – it is simply aggregated data showing changes in movement before and after restrictions went into place. Here’s a look at an example, showing and 83% decline in movement in Sydney since 2 March:
Aggregate data showing movement in Sydney has declined 83% since 2 March. src
The following is another example of aggregated data, showing a gradual decline in transport and travel in Sydney throughout the month of March:
Transport and travel declined throughout the month of March. src
Final words – What about privacy?
As stated, both Vodafone and the governments in question clam no personal information of users were shared. The data simply shows general aggregated information that indicates changes in movements.
However, this doesn’t mean that your personal information isn’t available to your telco – you can be tracked with your mobile location data if your telco chooses to do so. However, there would be some significant legal questions if this was to happen, hence Vodafone’s and the governments’ desire to stress that none of that has or will occur. In fact, NSW Customer Service Minister Victor Dominello said that NSW will “absolutely not” use customer data to check whether people were leaving their premises or enforce their isolation.
But here’s an example of just how possible that is: Back in February, South Australia’s health department traced possible coronavirus contacts through an infected couple’s iPhone location data. The couple gave consent to access the data in their iPhones, and their movement history was traced with the information found, determining exactly where and when they had contact with others.
Assuming extreme measures required bypassing user consent to access such personal information, will your privacy be at risk? Yes. Will your telco and the government be able to determine when you leave your premises and sanction you accordingly? Yes. Thankfully, though, we haven’t gotten to that and, if we ever do, hopefully the legal mechanisms in place will prevent it.