OTI and Coalition Oppose D.C. Department of Transportation’s New Rules Requiring Scooter and E-Bike Companies to Share Location Information

Last week, New America’s Open Technology Institute, along with coalition partners ACLU-DC, Center for Democracy & Technology, and Kandoo, sent a letter to the District of Columbia’s Department of Transportation (DDOT) opposing DDOT’s new rules requiring that dockless vehicle companies share user location information. Specifically, the organizations expressed serious privacy concerns regarding the new requirement that these companies—which provide scooters and e-bikes in the District—share their users’ sensitive location data in “as close to real-time as possible” with DDOT, as well as concerns related to the process under which this new requirement is being implemented.

On February 24, 2020, without any notice or opportunity for public comment, DDOT amended the 2020 Dockless Vehicle Terms and Conditions to require operators to provide highly sensitive information. This includes vehicle location data during trips “as close to real-time as possible, but with no more than a 3 minute delay” and the full route a person took on a vehicle “no more than 2 hours after the completion of a trip” via the Mobility Data Specification (MDS). The MDS is a tool that cities including the District of Columbia use to receive information from mobility providers, and defines what data they must share with the city. The District’s new requirement for dockless mobility providers raises serious threats to individual privacy and is being adopted without any meaningful accountability to the public.

OTI has previously written to the Los Angeles Department of Transportation regarding its adoption of the MDS, citing numerous privacy concerns related to location data sharing, which apply both to the District of Columbia and Los Angeles.

Given these serious privacy and accountability concerns, we urged DDOT to halt its plans to proceed with the new data sharing requirements, which were scheduled for enforcement on March 27, 2020, and engage stakeholders in the process of revising its requirements. Reports indicate that DDOT has delayed implementation of the requirement for two weeks, but this delay is likely insufficient; DDOT should abandon the intrusive new rule altogether.

The following quote can be attributed to Lauren Sarkesian, senior policy counsel, New America’s Open Technology Institute:

“The District Department of Transportation (DDOT)’s new requirement that scooter and e-bike providers share granular, near-real-time location data of users poses a serious privacy threat to District residents, and has no real justification. Such data could be used to track individuals throughout the District, yet the requirement is being implemented hastily and without transparency or public input—unrelated to, and pre-dating the current COVID-19 crisis. We urge DDOT to engage a diverse set of stakeholders and consider the privacy impact ahead of modifying or implementing any further data sharing requirements.”