Finding the right balance between mobility data-sharing in cities and personal privacy
As cities access data from mobility operators of shared bikes, scooters, and eventually cars, it is critical that we are aware of and take responsibility for protecting the private data of citizens.
Along with the rapid growth of shared electric scooters, cities across the United States, and now in fact across the world, are able to require access to data from private shared fleet operators through regulation. Cities, as stewards of the public right of way (our streets, sidewalks, and curbs), need data to help ensure that new mobility services, including Uber/Lyft, electric scooters, and eventually autonomous vehicles, are able to help meet public goals such as improving safety, transportation equity, and sustainability. It is important that they can understand how streets are being used to plan for the future of our cities.
New mobility data standards have emerged that help cities easily require and access highly granular, real-time data about vehicle locations and (now) trips. At Populus, we believe that public sector access to mobility data is critical for the future of our cities. Given much broader conversations about privacy and data, we also believe it is important for cities to proceed with care when requiring access to data from private companies, particularly given that much of it contains personal data that can easily be used to re-identify specific individuals and their whereabouts.
A Brief Overview of GBFS and MDS
The following are two transportation data standards that cities are adopting to require data from private mobility operators, including primarily dockless bikes and scooters, which are quite easily regulated.
General Bikeshare Feed Specification (GBFS)
The General Bikeshare Feed Specification (GBFS) was developed by the North American Bikeshare Association in 2015. Key characteristics:
- Reports real-time information of dockless bike and scooter systems and their available vehicles. (Note: does not include vehicles that are in use or removed by operators for rebalancing, maintenance, or other reasons).
- Reports current system status, location of vehicles (lat/lon), and availability. May also include vehicle battery charge level (e.g. for e-bikes and scooters).
Mobility Data Specification (MDS)
The Mobility Data Specification (MDS) was introduced in September 2018 by the Los Angeles Department of Transportation (LADOT) for the purposes of standardizing how cities receive data from mobility operators, such as shared scooters, that operate in the public right of way. Key characteristics:
- In addition to the status of available vehicles, MDS also specifies how information should be shared about vehicles that are unavailable due to rebalancing, maintenance, or low battery.
- MDS introduced a specification for sharing information about historical trips, including starts, ends, and full GPS trip trajectories/ routes.
- MDS is currently designed for shared bikes and scooters.
In November 2018, the Populus team and Lime partnered together to develop an extension of MDS to shared cars for the purposes of validating Lime’s use of on-street parking in Seattle.
The Rationale for Why Cities Need Data
We formed Populus precisely because our team believes that public agencies should have the ability to securely access sufficiently anonymized data from rapidly-growing fleets of private transportation operators in cities. As former transportation scientists and software consultants who spent the past decade building open source code for public agencies to make planning decisions, we witnessed firsthand the challenges that these agencies faced when trying to access such data.
Our team’s prior research as research scientists at UC Davis, UC Berkeley, and Stanford also suggested that without data and information, public transportation authorities would not be able to steer the fast-changing mobility landscape to achieve societal goals. Private companies are measured by performance metrics that are financially based, and it is the role of public agencies, and the policies they are able to enact, to ensure that new mobility services also deliver improved safety, equitable access, and sustainability.
There are several important use cases which require that cities have access to mobility data that we now deliver through the Populus platform, such as:
- Monitoring compliance with new dockless bike and scooter mobility policies such as the equitable distribution of vehicles.
- Harnessing historical parked vehicle data to design new scooter and bike corrals.
- Validating use of on-street parking by car-sharing vehicles.
- Assessing whether scooter riders are using existing investments in bike infrastructure, and if not, determining where new routes might be added.
Protecting Personal Privacy
Building on a decade of experience building travel simulation software, where highly granular cell phone traces have become a common tool for forecasting, our team has a deep understanding of how personal mobility data is, the necessary protocols for protecting it, and the methods for extracting useful insights for cities and transportation agencies while ensuring that the data cannot be used to re-identify specific individuals.
Anonymous vs. personal data. A growing body of research demonstrates that “anonymous” mobility data (data that does not specifically reference a person’s name, email, or address for example) can still be used to re-identify specific individuals, their whereabouts, and activities. Thus, GPS and location data is considered personal data according to more recent privacy policies such as GDPR. Although many recent city data-sharing policies do not require direct identifiers such as names or emails, they do require indirect identifiers, such as the starts and ends of trips or the entire GPS trace of a trip. These indirect identifiers can be easily combined with other datasets to identify specific individuals. At Populus, we believe this data should be treated as highly sensitive personal data and protected with adequate security policies and protocols.
Requirements for cities vs. private companies: Cities can and should set the bar higher for protecting individual privacy. Over the past few years, it has become quite apparent that the tech industry has largely failed at self-regulation, and that more should be done to safeguard personal data and prevent its misuse. Policy is rapidly moving in this direction, and at Populus we work to support cities’ abilities to responsibly safeguard the privacy of its citizens data, while ensuring that they have access to the insights they need to plan for the future of travel.
One of our key concerns is that if cities do not act with the utmost care and responsibility when requiring highly sensitive mobility data as part of current or new regulations that may arise, their rights to this data may be stripped significantly or entirely. Mobility operators such as ride-hailing services, and automotive companies before them, have long engaged in well oiled lobbying efforts at the state and federal level. When more local policies are not to their liking, they can and will seek a higher authority to supersede local regulation.
In the past few months since scooter data has been available to cities, we have seen granular trip data shared on open data portals or broadcast in real time. If cities proceed without the appropriate safeguards and ultimately fail to protect highly sensitive personal data, they could give private companies with significant financing all the rationale they would need to claw back access to data — and that would be a tragedy, because cities need better information to redesign our streets for safe and sustainable mobility.
An alarming number of pedestrians are being killed on city streets every year, and it has become increasingly clear that the planet cannot support our current transportation habits. Cities can and must play a key role in driving progress on transportation safety and efficiency, and they will need access to data and information to do so. At Populus, we urge cities to take privacy seriously as the floodgates to new mobility data open, because we believe that cities can and should have access to good information to steer our transportation future.
Regina Clewlow, PhD is the CEO and Co-founder of Populus, a data platform for cities to manage the future of mobility. Trusted by leading cities and the world’s largest mobility operators, the Populus platform securely ingests real-time data from shared electric scooters, bikes, and cars — helping operators and cities partner to deliver safe, equitable, and efficient streets through better data and analytics.
Regina has over a decade of experience in transportation, having served as a research scientist and lecturer at Stanford, UC Berkeley, and UC Davis. Prior to forming Populus, Regina was the Director of Business Development and Strategy at RideScout, an early mobility-as-a-service aggregator that was acquired by moovel, Daimler and BMW’s mobility services unit. She has a Ph.D. in transportation and energy systems from MIT, and a bachelor’s in computer science from Cornell.