Spime Watch: Intelligent Transport Systems raise privacy concerns

*I wonder how hard it would be to kludge-up one of these "almost infallible surveillance systems" as a p2p plug-in urbanware app. Probably not very hard. Seems like the sort of thing a moneyed "gated community" could do as a matter of course; or you could just buy the whole system from the Chinese once they finish distributing its commie-technocrat blessings to Tibet and Xinjiang.

*Via EDRI:

=======================================================
6. EDPS: New privacy issues in relation to intelligent transport systems

Peter Hustinx, the European Data Protection Supervisor (EDPS),
issued on 22 July his opinion on the European Commission's proposed plan,
adopted in December 2008, to accelerate and coordinate the deployment of
intelligent transport systems (ITS) in road transportation in Europe, and
their connection with other modes of transport . The deployment includes an
Action Plan establishing priority areas for action and a Directive proposal
laying down the framework for their implementation.

Intelligent Transport Systems (ITS) are applications using Information and
Communication Technologies embedded in different modes of transport that
interact between them (such as GPS systems), meant to make transport safer
and cleaner and to reduce traffic congestion. ITS applications and services
are based on the collection, processing and exchange of a large range of
data and allow for the tracking of a vehicle and the collection of personal
data such as driving habits. As such, they raise several privacy and data
protection issues. (((These systems raise an incredible host of issues, but Europe is unique among present-day polities in its institutional concerns with "data protection." Everybody is keen to buy cruel foreign spyware and snooping equipment, but I don't think the Europeans have ever managed to export so much as a megabyte of "data protection" to anybody else anywhere.)))

"The problem is not what the data tells the state, but what happens with
interlocking information it already has. If you correlate car tracking data
with mobile phone data, which can also track people, there is the potential
for an almost infallible surveillance system," said Simon Davies, director
of the watchdog Privacy International. (((Or they could correlate your credit cards
and your Google searches, which would be even more effective.
However, credit card companies and Google aren't "the state,"
so they tend to get a free ride from privacy advocates, who are lawyerly
types who imagine that governments still do something useful in these areas
of technological practice. It's like putting privacy padlocks under the streetlamps
because the light is brightest there.)))

(((You know who's still got huge, blessed, brimming
amounts of personal privacy? Ranking members of the Chinese Communist Party.
How do they manage that, I wonder? These guys have got offshore bank accounts,
ranks of concubines, all awesome stuff, and nobody outside the nomenklatura
even knows their names. Maybe the Chinese could export some privacy.)))

While welcoming the fact that the proposed ITS deployment plan aims at
harmonising the data processes throughout Europe, the EDPS however warned
that the proposed plan raised a series of issues related to privacy and data
protection. (((Nobody but the Europeans ever does "harmonizing," either.
However, the Europeans have successfully imposed incredible amounts of
"harmonizing" on people. You can walk the streets of any major city in
EU-candidate Croatia and the "harmonization" there is like a saturation bombing.)))

Hustinx believes there is a lack of clarity of the proposed legal framework
that might create diversity in the implementation of ITS in Europe thus
leading to different levels of data protection in Europe. "The EDPS
emphasizes the need for further harmonisation on these issues at EU level to
clarify outstanding issues (such as definition of the roles and
responsibilities of ITS actors, which specific ITS applications and systems
must be embedded in vehicles, the development of harmonised contracts for
the provision of ITS services, the specific purposes and modalities of use
of ITS etc)."

One important aspect in his opinion is that data controllers must be clearly
identified "as they will bear the responsibility to ensure that privacy and
data protection considerations are implemented at all levels of the chain of
processing." (((I'm liking the counter-idea of completely secret and private
data-controller privacy bureaucrats. Wouldn't it be great to be private to "all
levels of the chain of processing"? To heck with James Bond and his weak
cover as a universal export-import agent – to be private to "all levels of the
chain of processing" would be like a comic-book superpower.)))

Also, the data controllers providing ITS services should implement
appropriate safeguards "so that the use of location technologies is not
intrusive from a privacy viewpoint. This should notably require further
clarification as to the specific circumstances in which a vehicle will be
tracked, strictly limiting the use of location devices to what is necessary
for that purpose and ensuring that location data are not disclosed to
unauthorized recipients". (((This is amazingly super-logical political thinking,
until you realize that any civilian with an iPhone can snap and geolocate
anything or anybody and blow it to FlickR with a single button-push.
Except – if I work for any government? – I'm suppose to lobotomize
my ability to do any of that while at work.)))

The interconnection of the systems and applications must also be done "with
due respect for data protection principles and practical safeguards on
security," and personal data must be processed only if necessary "for the
specific purpose for which ITS is used and pursuant to an appropriate legal
basis". (((Easily as plausible as universal and ever-lasting Digital Rights Management.)))

The EDPS emphasizes the importance of not using the processed personal data
"for further purposes that are incompatible with those for which they were
collected" and he recommends the introduction of an explicit reference to
the notion of ''privacy by design'' for ITS applications and systems saying
that data "may not be used for purposes other than the ones for which they
were collected in a way incompatible with those purposes."

The EDPS recommends that privacy and data protection should be considered
during the early design stages of any ITS. "Privacy and security
requirements should be incorporated within standards, best practices,
technical specifications and systems."

His final recommendation is that data protection authorities, such as
Article 29 Working Party and the EDPS should be closely involved in all the
initiatives related to the deployment of ITS "through consultation at a
sufficiently early stage before the development of relevant measures."

European Data Protection Supervisor Opinion on the Communication from the
Commission on an Action Plan for the Deployment of Intelligent Transport
Systems in Europe and the accompanying Proposal for a Directive of the
European Parliament and of the Council laying down the framework for the
deployment of Intelligent Transport Systems in the field of road transport
and for interfaces with other transport modes (22.07.2009)
http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2009/09-07-22_Intelligent_Transport_Systems_EN.pdf

Big Brother is watching: surveillance box to track drivers is backed
(31.03.2009)
http://www.guardian.co.uk/uk/2009/mar/31/surveillance-transport-communication-box

Intelligent transport raises privacy concerns (23.07.2009)
http://www.euractiv.com/en/infosociety/intelligent-transport-raises-privacy-concerns/article-184309

(((Luckily, sort of, there's one area of governance where all of this regulation has not even a breath of relevance, and that's the intelligence services. If you're a European spy, you can have all of this you want. If you're not a spy, but merely working for the legal and elected government, you're gonna need some of that pre-designed artificial-stupidity hardware, which engineers-away your ability to abuse privacy.

(((Or you can just work for Google and try to split the policy difference between the US, the EU and China. Who knows the most about whom when and how? "Knowledge is power," did somebody say that sometime? Some European maybe. I can ask Brussels to tell me who said that, right? Must be in the ol' protected databank somewhere.)))