Anyone who has a smartphone is likely familiar with mobile applications (aka “mobile apps”). Mobile apps are software applications designed to run on smartphones, tablet computers and other mobile devices. The use of mobile apps has increased exponentially over the last few years bringing the number of individuals using mobile apps to almost half of all smartphone users. Given the fast evolution of the mobile industry privacy concerns have been, in some cases, overlooked by app developers and technology companies.
Privacy Concerns Related to Mobile Apps
Last year the Pew Internet Center, a Washington based nonpartisan fact tank, conducted a study entitled “Privacy and Data Management on Mobile Devices“. The study revealed that the majority of smartphone users are concerned with how their personal data is collected, used and disclosed through mobile apps. It was revealed that in 2012 57% of all app users have either uninstalled an app due to concerns with respect to sharing personal information or have refused to install an app altogether for similar reasons. This indicates that protection of personal information and privacy is a very real concern for smartphone users.
Another study was conducted by Juniper Networks’ Mobile Threat Center and analyzed over 1.7 million apps on the Google Play market from March 2011 to September 2012. This study had some very interesting and perhaps troubling findings with respect to individual privacy protection. In particular, the study revealed that free apps were 401% more likely to track a user’s location and 314% more likely to access user’s address books than paid applications. The study also found that free apps appear to be collecting information for reasons other than for advertising purposes. Moreover, a number of the apps analyzed had the ability to covertly initiate ongoing calls, send text messages and use phone cameras. These abilities, among other things, create the potential risk of the phone being used to “silently listen to ambient conversations” going on nearby as well as allowing a “third party to obtain video or pictures of the area where the device is present”.
Canadian authorities are taking issue with the lack of privacy protection provided in the mobile app industry. Most recently, this past January, the Office of the Privacy Commissioner of Canada (the “OPC”) in collaboration with the Dutch Data Protection Authority conducted an investigation into alleged privacy concerns relating to “WhatsApp”, a mobile app owned by a the California corporation, WhatsApp Inc. WhatsApp is a messaging service that allows users to send messages through their mobile device over the internet rather than by short message service, or text message. The application is available on iPhone, Blackberry and Android devices. The OPC was concerned that the application lacked security protection for message transmission thereby allowing messages to be transmitted unencrypted and exposed to potential interception by hackers. WhatsApp Inc. has since responded to this complaint by encrypting messages. The OPC was also concerned that the application was collecting more personal information then necessary and, in particular, it was concerned with the requirement that users provide access to their entire address book as a condition of service, including phone numbers of individuals not currently using the app on their smartphone. According to the OPC, the retention of phone numbers of non-users is unnecessary and could lead to inappropriate and unintended uses of these numbers. The OPC recommended that WhatsApp provide users with the option to manually enter contacts into the application. At the time of this report, WhatsApp provided iPhone users the option to manually enter contacts and confirmed that the latest Apple iOS application allowed for the manual entry of contacts. WhatsApp also confirmed that the same functionality was to be integrated into other operating systems. Other concerns voiced by the OPC included WhatsApp’s failure to adequately disclose to users the potential for widespread disclosure of personal information through status updates, WhatsApp’s lack of appropriate guidelines governing the retention of undelivered messages and WhatsApp’s policy regarding the retention of personal information of users who had deactivated the app and discontinued service. The OPC provided WhatsApp with a number of recommendations to resolve these issues and the app developer agreed to make the necessary changes to ensure its compliance with its privacy obligations.
How can Mobile App Developers Ensure Compliance with Privacy Legislation?
In October of last year the Privacy Commissioners of Canada, Alberta and British Columbia (the “Privacy Commissioners”) developed guidelines for mobile app developers to address privacy concerns entitled “Seizing Opportunity: Good Privacy Practices for Developing Mobile Apps“. It is important for app developers to be aware that they are responsible for personal information collected, used and disclosed through their app. App developers operating in the private sector and located in all provinces and territories, except Quebec, Alberta and British Columbia, are governed by the Personal Information Protection and Electronic Documents Act (“PIPEDA”). In Alberta, app developers operating in the private sector are governed by the Personal Information Protection Act. Even if your app is provided for free the legislation nevertheless applies. Here is a brief overview of some of the guidelines provided by the Privacy Commissioners:
(5) Timing of consent is important: Although it is important to provide users with information on privacy when they download the app, in order to obtain and maintain meaningful consent users should be informed of the collection of personal information throughout the use of the app so as to ensure that consent remains meaningful.
For more information, please find the full version of this report at http://www.priv.gc.ca/information/pub/gd_app_201210_e.asp.
Privacy concerns are clearly something that cannot be ignored by app developers or app users. Given the fast evolution of the mobile industry app developers must remain vigilant when it comes to protecting user privacy. Users should also be aware of what personal information they are disclosing and providing when downloading and using apps and how this information is being used and distributed. To assist users with privacy protection, the Office of the Privacy Commissioner of Canada has come out with its own mobile app that provides users with ten steps to assist them in protecting their privacy on their mobile devices. The app is called “myPRIVACYapp”. More information can be found on the Office of the Privacy Commissioner of Canada website.
The 2013 Digital Alberta Awards nominations are now open. Click here to apply.
Photo Credit: www.itp.net
Author: Meredith MacDonald
Meredith MacDonald is the Governance Chair for Digital Alberta. Besides her work on the board of Digital Alberta, she practices law at Norton Rose Canada LLP in the area of business law, with a focus on technology enterprises and intellectual property. Full bio.