The San Francisco Bay Area Rapid Transit District are being sued for allegedly breaching data protection rules.

In 2014, the San Francisco Bay Area Rapid Transit District (BART) launched a mobile app for users to discreetly and conveniently report suspicious or illegal activity to the BART police. The ingenious app meant the police force’s watchful eye in monitoring illegal activity could be extended through helpful civilians.

The app was made by software developer ELERTS Corp. However, it seems the co-operative app may be used in reverse, as it has been alleged that the BART police can track and monitor users of the app…

The exploitive information includes the users’ personal device identification number and location. A BART spokesperson, Alicia Trost, addressed the concern of spying:

“The safety and privacy of our users are a priority and we want to make clear we are not using ELERTS system for any other purpose than responding to security and safety reports made by our riders. BART does not use ELERTS system to randomly track users.”

Location tracking could lead to robberies?

Whilst BART is accused of spying on their users, it is the risk of a data hack that unsettles a lot of users. As the mobile device is usually the user’s personal mobile phone, hackers can easily find out where the user is. By monitoring where the user is during the night, hackers could theoretically figure out where their home is and when they leave it during the day; potentially leaving users vulnerable to robberies and break-ins.

Reportedly, the application doesn’t notify users that it collects sensitive information that could compromise the user’s identity and put them at risk. The application automatically downloads the user’s device identification and location for the applications database, but the lawsuit deems this database is unnecessary for the functioning of the app.

Privacy is essential

The law firm bringing the claim recognises that: “this is a very concerning privacy breach. Consumers are generally unwilling to offer their information for this to build a database. The people of California feel very strongly about their privacy.”

Data protection laws regulate how companies and authorities take, hold and use our information. It is important that the owner provides consent for their information to be held and used, as it belongs to them.

It’s common when downloading applications and content from the internet that the user will be asked to accept or decline terms and conditions. Whether or not the user actually reads the terms and conditions, they must tell the user about any information they will collect and what they intend to do with it.

The claimants are asking BART to stop collecting user information that includes their “unique cellular identifiers” and the location of the mobile device. They are also requesting that the information that has already been collected to be destroyed and if any third parties have accessed the data, the users should be informed. The fluid nature of data means that, once data is leaked, it can’t always be easily or fully rectified. Data protection laws govern the strict use of data. Once it is leaked, there is no way of telling in terms of its impact and the extent of any damage.