D11.6: Survey on Mobile Identity

The deliverable in hand provides the results of an explorative survey on the
control model for identity related data in location-based services (LBS)
presented in FIDIS deliverable D11.2.
The survey was performed to explore the influence of LBS characteristics (pull
vs. push based, indirect vs. direct profile creation) on the perceived amount of
control participants have about the disclosure of their identity.
Four scenarios, each reflected a different aspect of the control model, have been
designed and tested.

[Download]

The legal framework for LBS in Europe
THE LINK BETWEEN LOCATION INFORMATION AND PHYSICAL PERSONS

The link between location information and physical persons

In order to assess which legal framework applies to location data, it is important to know whether the location data are linkable to an individual person; in that case, they qualify as personal data (see section 4.2). Here, we give a rough indication of the linkability between location data and individuals for different LBS techniques; a legal assessment is more complex and often depends on concrete circumstances (see further sections 4.2 and 4.3).

In some cases there is no possible link between location information and a person, especially when location information is used in the context of objects only. One example for this is location information in the context of a fully automated warehouse. In this example location information refers to places in the warehouse and is used by machines only.

In most cases there will be a link between a device or a sensor used for LBS and a person. This link can be direct, e.g., by using purpose-specific devices (e.g. mobile emergency phones) and very stable, e.g., physical properties of the person (biometric features) or implants (both of them can not easily be changed). In many cases, however, this link is only indirect, for example in cases where a person uses an object which has an attached device that is part of the location system (e.g. a vehicle with GPS sensor, a product tagged with an RFID tag etc.). Indirect links can be fairly strong, i.e., with a reasonably high probability that the object and person are linked (e.g. a mobile phone of a consumer), but they can also be quite weak (e.g. with a company vehicle that is driven by several employees).

The following table gives an overview of the possible properties of the link between location data and a person for selected technological examples.

Technology examples	Linked to individual persons	Strength of the link
1) static sensors
1a) RFID in logistics	Usually no link when RFID tag is removed at the end of the logistic chain
1b) RFID implants	Always linked	Link is direct and very strong
1c) toll-collection	Usually linked for private vehicles (not for company vehicles)	Link is indirect and not strong, through car owner
1d) mobile phones	Usually linked, except in cases of certain prepaid cards	Link is indirect through phone number and reasonably strong
1e) license plate scanners	Usually linked	Link is indirect and not strong, through car owner
1f) Tracking using biometrics	Linked through biometric features	Link is direct and can be very strong, depending on the quality of the biometric system
1g) Chip-card location	Linked to location of the reader	Link is direct
2) mobile sensors
2a) GPS for objects	Possibly linked	Link is indirect, e.g. car navigation linked to car owner
2b) GPS for persons	Usually, e.g., in route systems	Link is indirect through the GPS locator
2c) RFID sensor on persons	Usually linked	Link is indirect through the sensor
2d) RFID sensor on objects	Usually not linked

Table : Examples of different types of links between location data and a physical person

9 / 47