Smartphone Location Data

Last week two UK-based researchers revealed that Apple iPhones record location-based data in an unencrypted file stored on each phone. The information, gleaned from WiFi routers and cellular towers within the phone’s signal range, has been collected without the knowledge of the phones’ owners, and would allow Apple to track each phone’s approximate location. Evidence suggests the data is sent back to Apple from the phones on a periodic basis. The researchers used the unencrypted information to reconstruct over a year of each smartphone’s movements. The Wall Street Journal reports that turning off the phone’s location-based services does not stop the phone from collecting and storing the data. In a recent press release, Apple answered several questions posed by this discovery, and explained that a software bug in its traffic-prediction software was responsible for the year-long retention period. Apple also said it would release a fix for the bug.

Nevertheless, the revelations have piqued European regulatory interest. German, French and Italian data protection authorities have now opened investigations into whether Apple has breached EU privacy rules regarding the tracking and storing of user location data. The Irish authority has said it is actively examining the issue after receiving complaints. The South Korean government authority has also said it will look into the issue, while meanwhile South Korean police arrested three men on 27 April for illegally collecting the location and movements of hundreds of thousands of South Korean smartphones, for use in mobile advertising.

In the United States, Apple and a number of other technology companies have been asked to respond to inquiries from Congress regarding the extent to which they collect, use and retain data in connection with their provision of location-based services.

Sony Declares Breach

In a separate matter this week Sony announced that the 76-million user PlayStation Network had been hacked. The company confirmed that data had been stolen from the system, potentially including sensitive data such as payment records, user names, and credit card details. The PlayStation Network has been shut down since 21 April, but until Tuesday the company hadn’t verified the reason for the shut down.

Irish, UK and Austrian data protection authorities have already confirmed their concern over the breach, and all three authorities have now opened investigations into Sony’s data security practices.