Location, Location, Location

Transcription

1

2 Location, Location, Location

3 Your Panel Ruth Boardman, Partner, Bird & Bird, Thomas Sheppard, CEO, PresenceAware Tech Ltd, Vanessa Mortiaux, Principal Legal Counsel, EE, Jules Polonetsky, Executive Director, Future of Privacy Forum

4 Agenda How the technology works How it is being deployed Codes of conduct Discussion

5

6 Setting the Scene "A lack of data, in the moden retail work, is suicide" Sir Philip Green

7 Online Retail ~20% of all purchases are made online.

8 Brick and Mortar Retail Leaving 80% of all purchases to be made in store. And measured by things like this.

9 A Question What If Our retailers had Google Analytics metrics for their physical stores?

10 How it works

11 Why it works Smartphone penetration crosses social grade, gender & age.

12 Who are EE? The UK's biggest and fastest network The most advanced digital communications company in the UK, with superfast 4G and fibre broadband that redefines connectivity for consumers and businesses.

13 EE WiFi Retail Example What location data? Device MAC address Store location Access to the WiFi service (connection/disconnection, date and timestamp) What use of the data? Marketing by retail customer based on stores visits Store entry/exit SMS/ or other types of communications Analytics and reporting (insights)

14 EE WiFi Retail Example Personal data? Data required to register for the WiFi service including name and mobile number (can be linked to location data) Constitutes personal data Data aggregated for analytics and reporting purposes Underlying data is personal data but output data is not

15 EE WiFi Retail Example What kind of consent? EE is a provider of public electronic communications services and PECR apply Marketing Processing of traffic data for a VAS Prior consent is required Other requirements (for example, opt out) Analytics and reporting (insights) Not a specified purpose under PECR Does the processing of the underlying data to create aggregate outputs constitute processing for a VAS requiring consent?

16 EE WiFi Retail Example Example: consent for location based marketing: "By ticking this box, I agree to EE sharing information with Store Owner about my visits to its stores so that Store Owner can send me personalised offers by SMS or using my store location information when I access the WiFi service [Un-ticked box]". Example: wording for analytics (T&Cs and privacy policy): "We will use your personal information for analytics including to provide analytics to third parties but these statistics will not include any information that is likely to identify you as an individual".

17 EE mdata

18 What data? BEHAVIOUR LOCATION DEMOGRAPHICS

19 Data Uses

20 Case Study: Outdoor Advertising Posterscope

21

22 Finance mcommerce Banking Technology Productivity Film Colours = Category Height = Volume

23 Super hotspots are often found in specific locations Rail Stations Bus Termini High Streets Business Districts Colleges Bus Shelters

24 Optimisation using Planner & EE data TRIPLED THE EFFECT of outdoor media in terms of: Ad Awareness Purchase Consideration Online Searches

25 mdata Data Privacy Issues

26 Is it personal data? Data that relates to our customers Within the analytics platform all personal identifiers have been removed Outside the analytics platform the data can be linked back to an individual customer e.g. with customer consent Aggregated data provided to third parties Not personal data Risk of re-identification is remote

27 Justification for the data processing? Legitimate business interests PIA DPA, Sch. 2(6)(1). No unwarranted privacy intrusion: Privacy by design approach Build privacy controls into systems from the beginning On-going review

28 Transparency EE Privacy Policy: We use personal data to "carry out research and analysis and monitor customer use of our network and products and services" for internal purposes and to provide "aggregated statistics about our sales, customers, traffic patterns to third parties, but these statistics will not include any information that is likely to identify you." On-going review How can we improve transparency? Plans on the way (watch this space!)

29 Purpose limitation and data security Purpose limitation: Strict guidelines and policies around permitted use Team dedicated to review any new business case Legal assessment required Data security: Data tokenisation/removal of personal identifiers Access granted in accordance with Access Policy Staff training Audit policy and auditing

30 Conclusion Location based marketing can: Bring great value to companies and their customer who want it Transparency, choice and control are key Location based analytics can: Yield great benefits for companies and their customers, drive markets forward and bring social benefits Privacy assessment, implementation of controls and on-going reviews are essential

31

32 Behind the Code Purpose: To promote consumer privacy and responsible data use for retail location analytics Resulted from discussions between the MLA companies, Senator Chuck Schumer, and the Future of Privacy Forum In consultation with the FTC Launched October 2013

33 MLA Code of Conduct Enforceable code of conduct under which participating companies have made concrete commitments to: Clear, short & standardized privacy notices Data will be maintained in a pseudonymous form Affirmative consent required before consumers identified or contacted Data deletion requirements Onward transfer restrictions Data may not be used for restricted purposes adverse to consumers Display of conspicuous signage

34 Pseudonymous Data Data that is not reasonably used to infer information about or otherwise be linked to a particular consumer, computer, or other device. Measures such as hashing a MAC address, aggregating data, deleting personally identifiable fields, adding noise to data, or statistically sampling are considered to be measures that pseudonymize data if a company: 1. Takes reasonable measures to ensure that the data is deidentified; 2. Publicly commits not to try to re-identify the data; and 3. Contractually prohibits downstream recipients from trying to re-identify the data.

35 MLA Opt Out Enforceable commitment under MLA Code Opt-out of collection and use of data for retail mobile location services Opt-out means Do Not Track and DO NOT COLLECT Central opt out for all participating companies Easy-to-use process for consumers to securely submit Wi-Fi or Bluetooth MAC address Educational information about retail analytics and consumer

36

37 Stay in touch! Jules Polonetsky, Executive Director and Co-Chair

38 Discussion

39 Finance mcommerce Banking Technology Productivity Film Scenario Colours = Category Height = Volume

40 Questions 1. Should we give notice if so, how? 2. Should people have an opportunity to object? Why? 3. What if a telco uses its retail Wi-Fi service network to generate the analysis. Does this make the service more intrusive? 4. What if this is a Wi-Fi service with registration and data is used to send targeted ads?

41 'The provider of a PEC service may process the [traffic/location] data if the subscriber or user to whom the data relates has given his or her prior consent '

42 THANK YOU