Hearing of the New York City Taxi & Limousine Commission on Proposed Driver Fatigue Rules for For-Hire Vehicles

Statement of Joseph Jerome, Policy Counsel, Center for Democracy & Technology, at the Hearing of the New York City Taxi & Limousine Commission on Proposed Driver Fatigue Rules for For-Hire Vehicles

January 5, 2017 (as delivered)

Thank for the opportunity to speak briefly today on behalf of the Center for Democracy & Technology. CDT is a nonpartisan, nonprofit technology policy advocacy organization dedicated to promoting digital privacy, free expression, and individual liberty. We fully recognize the NYC Taxi & Limousine Commission’s mandate to regulate safety for both yellow cabs and for-hire vehicles, like Ubers and Lyfts, in New York City, but we believe that the TLC’s proposed rule to address driver fatigue presents real privacy risks.

CDT has described our concerns in a public letter to the TLC, cosigned by a number of leading privacy organizations [1]. My comments today focus on how this proposal conflicts with the longstanding privacy protection principles of purpose specification and use limitation.

These principles require entities to collect and store data in a deliberate way, keeping only what is necessary for a defined purpose. Together, they promote basic data management and protect individual’s privacy.

CDT regularly questions industry practices when companies claim to collect information for one purpose, and ultimately use it for others. In fact, we have even recently raised concerns about some of Uber’s efforts to collect additional location information from passengers. We believe embracing purpose specification and use limitation are important for not just the private sector, however. These limitations are vital for public sector initiatives and regulatory proposals, as well.

Yet the TLC’s proposal to combat driver fatigue does not impose any such restrictions on its own use of this data once it has been shared from a for-hire vehicle company. Instead, the proposed rules leave wide open the possibility that drop-off data – and whether trips are shared among passengers – may be used in support of “other enforcement actions.” This is commonly known as “mission creep.”

To avoid this, any proposal to address driver fatigue should include language that explains clearly how the data collected will be used to address this specific problem. The TLC’s proposal changes only a few words to Section 59B-18 of Title 35, but it has significant implications for privacy because it lacks purpose specification and use limitations.

Indeed, the TLC’s proposal itself includes clear references to potential mission creep. The language mentions that drop-off location can be used to help investigate complaints “including for incidents alleged to have occurred during or between trips, by allowing TLC to determine the location of a vehicle at a particular time.” However, collecting drop-off locations does not assist with this sort of enforcement, and to the extent the TLC wishes to address rider and pedestrian complaints, it should do so in a separate proposal.

While CDT applauds the TLC’s recognition that it should maintain the “privacy and confidentiality” of this information, we would encourage the TLC to further engage with us – and other privacy organizations – on its data collection and security practices. Public documentation is sparse. We note that two years ago, the TLC’s documentation on FHV Trip Record Submission devoted only two paragraphs to “privacy” issues.

We believe the TLC can do more to address the privacy risks that are inherent in the collection of more and more sensitive information, and CDT stands ready to contribute to further efforts by the TLC in this regard. Thank you again for your time this morning.

 

Joseph Jerome
Policy Counsel, CDT

 

[1] Letter to the NYC TLC from the Center for Democracy & Technology, Constitution Project, Electronic Frontier Foundation, Future of Privacy Forum, and Tech Freedom (Dec. 29, 2016), available at https://fpf.org/wp-content/uploads/2016/12/TLC-Fatigue-Comments-from-FPF-CDT-EFF-Constitution-Project-and-Tech-Freedom.pdf.