Turns out using a smart trashcan to randomly track passersby isn’t OK

Last Friday we covered an exciting new initiative from a London startup called Renew, which runs smart recycling bins with advertising screens on them. Renew had started to use these bins to track the smartphones of passersby, logging the devices’ unique MAC addresses in order to figure out who the manufacturer is – the idea was to more accurately target the ads on the bins’ screens at the people around them.
At the time, I suggested that this might not be legal under UK and European privacy laws. Regulators there see the combination of a mobile device’s MAC address and location as personal data — after all, this basically creates a log of which device was passing by the bin at which time. And it seems the authorities have also realized there’s something potentially wrong with the setup.
The area where this trial was taking place is the City of London, a financial district administered by the ancient and very weird City of London Corporation. On Monday the Corporation said it had ordered Renew to stop snarfing people’s personal data. According to a spokesman:

“We have already asked the firm concerned to stop this data collection immediately and we have also taken the issue to the Information Commissioner’s Office. Irrespective of what’s technically possible, anything that happens like this on the streets needs to be done carefully, with the backing of an informed public.”

The Information Commissioner’s Office (ICO), which is the UK’s generally less-than-proactive privacy watchdog, told me:

“Any technology that involves the processing of personal information must comply with the Data Protection Act. We are aware of the concerns being raised over the use of these bins and will be making enquiries to establish what action, if any, is required.”

I can’t say I’m sorry to see the pause button pressed on the slurping of MAC addresses by smart trashcans, simply because the scheme in question involved no user knowledge, let alone consent. The obscure online opt-out form felt more like an insult than something to ease people’s minds.
Of course, this doesn’t mean people aren’t getting tracked as they travel around – mobile devices are inherently bad for privacy, and London is notorious for its profusion of CCTV cameras – but it does feel like an important principle has been upheld here, for now at least.