Who gets to know where you go on your scooters and e-bikes? This is, at least on the surface, the heart of a fight between Uber and the city of Los Angeles.
Earlier this month, L.A. suspended Uber's Jump-brand electric scooters and bikes from its one-year test program after the company repeatedly refused to share real-time data that was required under the agreement.
But they're still on the street.
That's because Uber filed an appeal with the city, which keeps its dockless fleet rolling while a hearing is scheduled.
Uber has also threatened to sue the city over the data-sharing policy "to defend Uber's constitutional rights," company spokesman Davis White said, alleging that the city government is exceeding its authority by "demanding free ownership" of confidential trip data created by Uber.
It's been a lot of bluster, but so far no brakes. Here's what's going on behind the scenes and on the streets.
WHY ARE LADOT AND UBER AT ODDS?
Officials from Uber, which owns Jump, freely admit the company has never been in full compliance from the start of LADOT's dockless mobility pilot program.
The program, launched last spring, aims to study how electric scooters and bikes are used and how they move throughout the city in an effort to create a data-based standard for how the vehicles will fit into L.A.'s big-picture mobility future.
All scooter and e-bike companies operating in the city are required by The L.A. Department of Transportation to submit real-time location data on all their vehicles, including trip starts and ends.
"We don't have to rely on each of the companies pitching us and telling us what it is they need -- we can see it," Marcel Porras, LADOT's chief sustainability officer, told LAist back in May. "We can see where they're deploying, we can see where the hotspots are (and) we see where the pain points are for community stakeholders."
There are three key data points the city collects:
As part of the agreement with scooter companies, trip starts and ends are to be provided in real time (within about 5 seconds), while the actual path riders take is provided on a 24-hour delay.
Uber has been out of compliance, LADOT spokesman Colin Sweeney explained, because they are not providing that key data in real-time. Uber is sending trip start and end data on a 24-hour delay. This has created a blind spot that could impact public safety, according to LADOT officials.
If LADOT can't see where Jump's vehicles are in real-time, they can't check if they're obstructing building entrances and wheelchair access, or "blocking fire hydrants or other emergency infrastructure," Sweeney said. He added that the sharing delay also opens the possibility that Uber is "scrubbing" or tampering with its data.
WHAT 'IDENTIFIABLE' MEANS
Uber argues its recalcitrance in releasing the required raw data with two key points: 1) it's too personal and 2) it violates company policy.
Uber maintains that the geolocation trip data should be considered personally identifiable information, or PII, company spokesman Davis White told LAist.
The Los Angeles Department of Transportation does not share this interpretation of the data. LADOT says on its website that it's stored "free of any personally identifiable information." Sweeney said LADOT only collects information on the electric vehicles, not on the people riding them.
"LADOT treats trip data as confidential and not subject to public records request," Sweeney said. "It is only released on the order of a subpoena. Furthermore, raw data is never shared with third parties in accordance with LADOT privacy guidelines."
In an Oct. 28 letter from Jump to LADOT, the company says that the city officials running the scooter program did not have clear data-sharing rules or privacy protocols in place at the beginning of the pilot and that Uber staff had to fight to get those defined over time.
"Jump riders in Los Angeles have a reasonable expectation of privacy in the trip data created from riding on our bikes and scooters," Uber said in a statement. "We sincerely hope to arrive at a solution that allows us to provide reasonable data and work constructively with the City of Los Angeles while protecting the privacy of our riders."
Uber's stance echoes some of the pushback LADOT has received from the Center for Democracy and Technology, a nonprofit group of personal data advocates. In an open letter last year, the organization argued that L.A.'s mobile data specification "raises significant privacy and security concerns," arguing that the trip data is a potential form of PII.
"Location information is among the most sensitive data, especially when collected over extended periods of time," the group wrote in the letter. "People's movements from place to place can reveal sexual partners, religious activities, and health information... even de-identified location data can be re-identified with relative ease. LADOT must take deliberate steps to protect this highly sensitive information."
Uber's second argument is tied to their initial argument: "LADOT's requirements for personal real-time trip data violates our company policy," White said, explaining that Uber's current privacy policy states that the company does not share data without the consent of the user. That includes sharing data with governments.
IS UBER THE ONLY COMPANY FIGHTING THIS?
According to Sweeney, the other dockless vehicles operators, including Bird, Lime and Lyft "have been partners in good faith," with Uber the lone dissenter regarding data-sharing.
Like Uber, Lyft has expressed concerns over data privacy, including in a letter to LADOT General Manager Seleta Reynolds. In that letter, Lyft officials said LADOT's data-collecting process "violates the reasonable privacy expectations of our customers."
That letter went unanswered, according to Lyft spokeswoman Lauren Alexander, and the rideshare company continues to provide the real-time data per the conditions of its operating permit with the city of L.A. But Lyft is supporting Uber's efforts from the sidelines.
"We have been advocating tirelessly on the various privacy concerns created by Los Angeles's current MDS model and hope that [Uber's] impending lawsuit will jumpstart a more meaningful dialogue on how to address them," Alexander said.
Lime declined to comment for this story and Bird did not respond to requests for comment.
UBER'S DATA PRIVACY TRACK RECORD
Uber has a good reason to approach data privacy with an abundance of caution, given its infamous 2016 data breach and cover-up.
All 50 states and Washington D.C. filed lawsuits against the company and in the end, Uber agreed to pay $148 million and put stronger data security measures in place.
Their argument now is that they can't give LADOT what it wants without violating their new security policies -- and the federal settlement agreement.
A QUESTION OF TRUST
We asked White for Uber's perspective on the main underlying concern about sharing data with LADOT:
Was it a lack of confidence that the city can be trusted to not abuse or exploit the data? Or
Was it more that they don't trust the city to keep that data secure?
"Both really," he said, adding that at the start of the pilot program, Uber "pushed" LADOT to enact policies to restrict data access to only the city employees that needed it to perform their duties. "LADOT eventually relented and agreed to that," White said.
Sweeney pointed out that LADOT is responsible for processing a myriad of data every day, including managing "parking meters that collect financial data."
"The idea that the department can't be trusted with data is a little much," he said.
The hearing to appeal their permit suspension has not been set, but Sweeney said they are generally scheduled within a month. As for that lawsuit Uber has brandished, "all options remain on the table," Davis told LAist on Monday.
In the meantime, Jump's scooters and e-bikes will remain available on L.A. streets -- even though the city doesn't know precisely where they are.
UPDATES:
10 a.m. Friday, Nov. 15: This article was updated with additional information and comment from Lyft on data privacy concerns.
This article was originally published at 9 a.m. Tuesday, Nov. 12.
