Thread by @WolfieChristl

Predicio, a French data broker who was caught selling location data harvested from ordinary smartphone apps to the US defense contractor Venntel, also provides 'foot traffic data' in partnership with Aspectum, another US company who sells to law enforcement and homeland security.

Aspectum (aka EOS Data Analytics) claims to provide 'geospatial insight based on cell phone activity and other data sources for a better understanding of local social interaction hazards' such as 'demonstrations, protests, riots, and other mass civil disorder acts', for example.

Sources:
aspectum.com/industry-publi…
aspectum.com/data-on-demand/

As a part of a 'combined offer from Aspectum and Predicio', that 'enables' clients 'to track and analyze human activities', 'foot traffic data' is 'available for selected countries' including the US and most EU countries.

So-called 'foot traffic data' usually refers to commercial location data secretly harvested via smartphone apps, often tied to unique personal identifiers.

According to Aspectum's website, Predicio seems to be their main provider for location data, but this must not be true.

"The real-time map displays current protests hotspots, estimates numbers of participants by city..."

Here's how Aspectum has visualized Black Lives Matter demonstrations in June. It's not clear whether they included smartphone/location data here, though: aspectum.com/blog/aspectum-…

Promo video on YouTube that shows how Aspectum and Predicio identified 75 individuals who met on a train platform in Paris, and then tracked 'their movements around the city during the next 2 weeks', where they 'crossed paths with 100000 other users':

Here's the recent investigation by @martingund that describes how Predicio obtained location data from weather+navigation apps and sold it to Gravy/Venntel, the US firm who is selling location data to US federal agencies:
nrkbeta.no/2020/12/03/my-…

Thread:

https://twitter.com/WolfieChristl/status/1334839943957516289

In addition to Aspectum, the French data broker Predicio mentions other 'trusted partners', including the European branch of the Interactive Advertising Bureau (IAB), representing the online advertising industry.

It also mentions Datarade and Narrative.
location-data.predic.io/location-data-…

According to a listing at Datarade, a kind of yellow pages directory of data brokers, Predicio sells data on the movements of 61.5 million 'daily active' app users in many countries including GPS location and personal identifiers:

https://twitter.com/WolfieChristl/status/1334967836490526720

(screenshots from Dec 4)

In addition, Predicio sells location data to (or via) Narrative, another US data broker.

This is interesting, because Narrative also lists Complementics, the second company who sold app location data to US defense contractor Venntel, as a 'data provider'.
narrative.io/data-partners

Narrative claims to (re)sell data on 2 billion mobile devices from 17 data providers. Location records include at least 'latitude and longitude of a given device', the 'time of the observation' and a 'unique identifier for a device or user'.

/cc @CNIL_en

narrative.io/data-types/loc…

I don't think that gathering personal data in the form of location records from smartphone apps and selling access via a data broker can be done in a GDPR compliant manner, especially not when the data broker's privacy policy doesn't even mention the GDPR.
narrative.io/privacy-policy

As I said earlier, if I were an EU data protection authority and I'd have sufficient grounds for suspicion that an EU company processes/sells personal data on millions without a legal basis, I'd raid offices and seize server access to investigate stuff.

https://twitter.com/WolfieChristl/status/1334496281750888454

Also, it is LONG overdue that EU authorities crack down on data companies in the US and elsewhere, who are monitoring behaviors in the EU at scale.

There is enough evidence out there on the web, in reports etc. The location data industry would be a low-hanging fruit.

Oh, I wonder why did Predicio take down its website?
predic.io

Statement by Aspectum. I suggest this should be investigated by EU DPAs.

https://twitter.com/Aspectumapp/status/1338881719139766273

Anyway @Aspectumapp:

1) Are you aware how 'personal data' is defined in the GDPR?

2) Are you sure you do not process pseudonymous personal data rather than anonymized data?

3) How can you follow the movements of 75 persons w/o processing personal data?

https://twitter.com/WolfieChristl/status/1338508268306624514

I doubt that this 'combined offer' on the 'Data on Demand' page of Aspectum's website doesn't involve processing of personal data as defined in the GDPR.

If it would, Aspectum+Predicio would be joint data controllers, and need a legal basis to process it.
aspectum.com/data-on-demand/

Oh my, now they also took the Youtube video that shows how Aspectum and Predicio identified 75 persons and then tracked their movements down 🤔

That doesn't make much sense. Predicio's website is on archive.org, and of course, I archived the video before tweeting...