Spatially Speaking
Blog Home All Blogs
Search all posts for:   


View all (210) posts »

MAPPS Best Practices on Privacy of Geospatial Data

Posted By John Palatiello, Friday, May 1, 2015

Comments due to MAPPS by May 15.

Recent legislative and regulatory efforts to protect consumers and citizens, in the name of “privacy”, have cast a wide net creating unintended consequences for mapping and geospatial firms. Geospatial data is derived from images and data collected from a variety of airborne and space borne platforms, as well as other mobile and terrestrial-based acquisition systems. This imagery and data is regularly and historically collected, utilized and applied in geographic information systems (GIS) by companies engaged in free market commerce and by government authorities operating within the safeguards, rights and framework established by the Fourth and Fourteenth amendments to the Constitution of the United States.

The Federal Trade Commission (FTC) proposed to protect the privacy of individual citizens’ "sensitive” data, including "precise geolocation data” that included, for example, an address. However, FTC did not define the term "precise geolocation data” and a report recommended that before any firm could collect, store, or use such data, it would be required to "provide prominent disclosures and obtain affirmative express consent before using consumer data in a materially different manner than claimed when the data was collected...". While the surveying, mapping and geospatial community generally, and MAPPS members particularly, provided substantial comments on the first draft of the FTC report, in March 2012, the FTC final report, “Protecting Consumer Privacy in an Era of Rapid Change”, provided only a single footnote to address the geospatial community’s concerns. It said:


"With respect to use of geolocation data for mapping, surveying or similar purposes, if the data cannot reasonably be linked to a specific consumer, computer, or device, a company collecting or using the data would not need to provide a consumer choice mechanism. Similarly, if a company takes reasonable measures to de-identify smart grid data and takes the other steps outlined above, the company would not be obligated to obtain consent before collecting or using the data.”


In the report, the FTC went on to note “the Commission calls on individual companies, trade associations, and self-regulatory bodies to adopt the principles contained in the final privacy framework, to the extent they have not already done so.”

In an effort to establish best practices, principles and a self-regulatory framework for its member firms, a MAPPS task force led by President-Elect Susan Marlow (Stantec, Nashville, TN) has drafted guide to meet the FTC’s challenge.  The following was presented to the MAPPS membership for review and comment earlier this year.  This draft has been reviewed by the MAPPS Board of Directors and approved in principle, pending final review and comment by the membership:

MAPPS, is the only national association of firms in the surveying, spatial data and geographic information systems field in the United States. MAPPS member firms are engaged in surveying, photogrammetry, satellite and airborne remote sensing, aerial photography, hydrography, aerial and satellite image processing, GPS and GIS data collection and conversion services. Our associate members include firms that provide products and services to our member firms, as well as other firms world-wide.

MAPPS member firms conduct their business in accordance with high ethical, moral and legal standards, efficiently, in good faith, and in the best interests of their respective companies, their employees, shareholders and other related stakeholders.  MAPPS member firms maintain business practice standards that earn the respect of everyone with whom the companies conduct business.  MAPPS member firms are a part of the geospatial profession that provides geospatial products and services to a broad range of markets.

Geospatial information plays an important role in our society.  Almost all human activities and decisions have a geospatial component.  In general, the value of personal information increases when it is connected to a location.  All kinds of personal information can be connected to a geospatial location such as financial data, health data, and other consumer behavioral data.  With the rapid technological development and wide uptake of smart mobile devices a whole new category of location based services is developing. 

The phrase “precise geolocation information” is becoming a part of many legislative actions.  The word “precise” may be misleading and if left undefined will wreak havoc in the geospatial community. Most importantly, a clear and concise definition will protect the public’s well-being and safety by enabling citizens and consumers access to data, devices, and location based services such as E-911, electronic lost and found, and navigation. The term should be defined to accomplish the actual goals of the legislation and not result in unintended consequences such as thwarting legitimate and desired business activities or denying consumers the products, technologies, and services they are demanding in the marketplace.  The purpose of most of the legislation is to protect personal and private information of individuals that have not given consent to collect such information.  This policy is intended to define the best practices for protecting personal privacy when collecting geospatial data. 

There should be a distinction between the term “precise geospatial information” and “precise personal geospatial information”. 

MAPPS recognizes and agrees that everyone has the right to protect their personal data.  Personal data should only be gathered legally under strict conditions, for a legitimate purpose. Furthermore, persons or organizations which collect and manage personal information should protect it from misuse and should respect certain rights of the data owners.

Individuals regularly disclose personal information such as their names, photographs, telephone numbers, birth date, and address while engaged in a whole range of everyday activities. This personal data may be collected and processed for a wide variety of legitimate purposes such as business transactions, joining clubs, applying for a job, and so on.  Also, when purchasing devices with GPS technology, such as smart phones, individuals typically agree to share their location.  Sharing your location can provide an enormous amount of personal information about your habits and behavior. 

When should a company obtain individual consent when collecting geospatial data?

Any information about the location and shape of, and the relationships among, geographic features, including remotely sensed and map data.


Any graphical or digital data depicting natural or manmade physical features, phenomena, or boundaries of the earth and any information related thereto, including surveys, maps, charts, remote sensing data, and images.


Collection, storage, retrieval, or dissemination of graphical or digital data to depict natural or manmade physical features, phenomena, or boundaries of the earth and any information related to such data, including any such data that comprises a survey, map, chart, geographic information system, remotely sensed image or data, or an aerial photograph by surveyors, photogrammetrists, hydrographers, geodesists, cartographers, or other such mapping and geospatial professionals.


Data originating from commercial satellite systems licensed to operate by the U.S. government, global positioning systems, geographic information systems, and airborne or terrestrial mapping equipment. 



Collection, storage, retrieval or aggregation of information about an individual that is publically available such as legal information found in deeds, property records, and property maps


Personal information about an individual’s real time geospatial location


Personal information that is protected under law such as health and employment information. 



Data depicting the physical locations of street addresses, without associated personal information.



This post has not been tagged.

Share |
Permalink | Comments (0)