Quebec Will Force Uber to Share Your Trip Location Data

A new law that regulates taxis and ridesharing apps in Quebec will require real-time geolocation data, including pick-up/drop-off points and route information, to be shared with municipal governments and approved third parties.

Bill 17, passed by Quebec’s National Assembly last month after stiff opposition from the taxi industry, brings taxis and ridesharing companies under the same regulatory regime. But it was amended at the last minute to require devices that collect real-time geolocation data to transmit that information to the local municipality, any municipal transit agency, and any private transport company the government designates.

Those devices could include both the phones running ridesharing apps such as Uber, as well as web-connected taxi metres.

The law will come into effect next October.

Privacy advocates say plans like these are a potential nightmare. Ride data from Uber, Lyft, and taxis can paint an unsettlingly personal picture—where you live, where you work, or, for example, if you regularly see a medical or mental health specialist.

“Real-time and individual-level trip data is particularly sensitive information, even when obfuscated to some degree. It can often be re-identified, and could create a comprehensive view of the movements of individual Quebecois,” Kelsey Finch, senior policy counsel at Washington, D.C. think tank Future of Privacy Forum, said in an email. “There may be other, less risky data that would still let the government achieve its goals.”

The amendment seemed to recognize the huge privacy implications of collecting geolocation data with a clause stating that the measures “must ensure the anonymity of passengers” and that the data must be generalized to about 50 metres or to the nearest intersection, whichever is closest. It’s not clear how municipalities will use this data.

A spokesperson for Transportation Minister François Bonnardel told VICE that the Quebec government has no intentions to publish the geolocation data. “What will be available is the list of geolocation devices,” they said.

The government also says it will set out, by regulation, which private transportation companies will have access to the data, and whether it will require more data to be collected and shared by these geolocation devices.

Uber raised concerns after the amendments were added to the bill. “Uber remains committed to the privacy of our customers and encourage governments to work closely with privacy experts when developing new data-sharing laws,” Uber spokesperson Melanie Ensign said in a statement. “Providing access to real-time location information of private citizens raises serious questions regarding privacy rights and we will seek further information from the Quebec government on how we can ensure these rights remain protected.”

Finch said that before sensitive personal information is collected, it’s crucial that all stakeholders are consulted. “In this case, it is not clear that the government has fully engaged with individuals, communities, and businesses to build sufficient trust and agreement about how to collect and use location information,” Finch said.

Quebec isn’t the first to greenlight this sort of data collection. New York City publishes location data from all trips taken in both rideshares and taxis, although the locations are generalized to zones that correspond to entire neighbourhoods and areas (the East Village, for example, is a single zone). Chicago has taken similar steps, generalizing the data to census subdivisions.

Earlier this year, VICE reported on how Los Angeles is forcing scooter companies to transmit real-time GPS data to the municipal government there, though a fight has brewed over compliance with those rules.

“We have opposed efforts to require companies like Lime and Bird to share location data with local governments,” said Karen Gullo, senior media relations specialist at the Electronic Frontier Foundation. “We have published privacy protection guidelines for gig economy companies that call for minimizing the scope of their data collection, and finding ways to transform data sets from individual data points into aggregate statistics whenever possible.”

Follow Justin Ling and Joseph Cox on Twitter.