Coordinates of millions of smartphones feared stolen, sparking yet another lawsuit against data broker

Gravy Analytics has been sued yet again for allegedly failing to safeguard its vast stores of personal data, which are now feared stolen. And by personal data we mean information including the locations of tens of millions of smartphones, coordinates of which were ultimately harvested from installed apps. A complaint [PDF], …

[Doctor Syntax]

The data we use is already commercially available data collected via smartphone apps, purchased at scale by data brokers or aggregators, then licensed to Gravy Analytics and other organizations like ours."

It is high time people like this were made to regard such data not as valuable but as toxic. If a business like this is sued so many times it's likely to just be bankrupted and nobody gets adequate redress. The senior management and directors should be personally liable for civil suit and also criminally liable. Perhaps that should also extend to the aggregators who licenced it to them. Make the whole supply chain liable.

[Neil Barnes]

If you don't collect the data

then there is no reason to worry about its security and the way it is used.

Just stop it. Now.

[Anonymous Coward]

Maybe there should be laws forcing smart phone OS's to have privacy switches to turn off the availability of data. Maybe they should first time boot in a privacy mode and the user can turn on what data sharing they want to allow. There should be clear warning when you turn on sharing that it's not your data anymore, you have just made it public.

[Frank Bitterlich]

Privacy control

You can typically decide which data an app can access. However, it is technically almost impossible* to enforce what an app or service does with that data, especially when the function of that app depends on that data being transferred to a server (eg. Tinder etc.) You can require app vendors to have comprehensive privacy statements, but these are mostly just "swindle sheets".

"We value your privacy. In order to provide you with this service, we share your data with 975 partners. This is necessary because, well, um, we want the money."

* For any references to how useless the GDPR is thanks to the concept of "reasonable interest", please refer to any one of my other rants here on this forum.

[tiggity]

Re: Privacy control

@Frank Bitterlich

Indeed.

If someone uses a phone app that requires location data (e.g. beer review app I use wont find locations of pubs properly unless GPS on & it can search on proximity) then that is not the same as granting someone permission to store / sell / generally abuse that location data & companies trying to claim they have such permission are just lying. e.g. in beer review app I'm OK with users of the app to see the pub I visited & when I did a review but that does not translate to saying that gravy train can flog that location data* to all and sundry.

* Not that any third party will get anything very exciting as only have location data turned on when use the app, then it is off again.

[Frank Bitterlich]

"unjust enrichment"?

Since when is unjust enrichment illegal in the United States?