Last week, the Cyberlaw Clinic filed an amicus brief in Sanchez v. Los Angeles Department of Transportation, a Ninth Circuit case about the reasonableness of the Los Angeles Department of Transportation (LADOT)’s requirement that rental scooter companies like Uber and Lime provide their mobility data–which includes location information–to the city. The Clinic’s amicus brief, filed on behalf of seven individual technologists, urban planning experts, and geoprivacy researchers, argues that the lower court erred in its finding that the mobility data specification (MDS) data was anonymous, and that at the very least, the court should have allowed discovery so that any decision as to the reasonableness of the search could be based upon a full understanding of the data collected and the city’s needs.
Sanchez, the plaintiff in this case, is an LA-based scooter rider, who sued LADOT over its requirement that scooter companies provide significant amounts of rider data, including the start and end location (in real time) and the route (within 24 hours) of every scooter trip in the city. LADOT used a system referred to as the Mobility Data Specification (“MDS”) system to collect the data. The lower court judge dismissed the case on a motion to dismiss, finding that there was no reasonable expectation of privacy in the MDS data, and even if Sanchez did have an expectation of privacy in the data, the city’s search was reasonable in light of its goals.
The Clinic’s amicus brief focuses on why the court’s findings were inappropriate at this stage of the litigation, as well as why they are factually incorrect. Our clients (John Clary, Greg Griffin, Joseph Lorenzo Hall, Jennifer King, Grant McKenzie, Arvind Narayanan, and Rebecca Williams), are able to back up Sanchez’s claims in his initial complaint that MDS data is easily linked to individuals, whether through simple physical observation or the comparison of multiple datasets. We cite to research showing that human mobility patterns are unique, and that just two time-stamped locations (such as the start and end of a scooter trip) are sufficient to uniquely characterize more than 50 percent of individuals, as well as examples where law enforcement has used physical observation combined with scooter data to identify individual people.
Even more important than the lower court’s disregard for the facts of how MDS data works are the procedural problems with ruling on the reasonableness of LADOT’s data collection choices at the motion to dismiss stage of litigation. As it currently stands, many facts about the data collection remain in dispute, including whether the MDS data gathered by LADOT includes data from scooter riders’ cell phones, gathered via a process known as multi-source verification. Under a Ninth Circuit case called Naperville, the reasonableness of an administrative search turns on the particular circumstances of the data collection, including the granularity of the collection and the likelihood of law enforcement access. Our amici explain why the granularity of the data collected by LADOT is unnecessary for some purposes (such as monitoring traffic patterns), while it may be insufficient for others (such as identifying if a scooter is on the sidewalk, one claimed rationale of the MDS data collection).
Cyberlaw Clinic Summer Intern Abby Lemert served as the primary writer on the brief, with support from Cyberlaw Clinic Instructors Kendra Albert and Mason Kortz. Summer Clinic Intern Navya Dasari and Spring 2021 Clinic Student Yihan Zhuang also provided support. We are thankful to Riana Pfefferkorn, who spotted an important typo on a last-minute read. The Clinic was grateful to represent this knowledgeable group of amici and hopes that the Ninth Circuit takes their expertise seriously in considering the appeal.
Lime scooters. Image by Baldesteinemanuel326, CC BY-SA 4.0.
