San Francisco's public transportation agency and the creator of the agency's suspicious activity reporting smart phone application have been accused of illegally collecting, tracking, and storing users' personal information and location data without their consent, in violation of California statutory and constitutional protections. A putative class action complaint, which was filed this week in a California federal court, has alleged that the San Francisco Bay Area Rapid Transit District ("BART") and Elerts Corp, a private software developer, created and made available to the public a free smart phone application that secretly collected users' unique mobile identification numbers and allowed BART and Elerts to track a user's location, amassing data that effectively removed any user anonymity. This conduct allegedly has violated California's Cellular Communications Interception Act, Consumers Legal Remedies Act, and privacy rights guaranteed in Article I of the California Constitution.
According to the complaint, BART and Elerts joined forces in 2014 to launch BART Watch, a free Android and iOS smartphone application that allows users to discretely and – if the user chooses, anonymously – report suspicious activity in the BART system to the BART Police. However, BART Watch's software allegedly contains code that accesses and shares a user's personal data – such as the phone's International Mobile Equipment Identity number – and other unique information, including GPS data, with the application's servers. These actions allegedly occur even if a user submits a report to BART Police anonymously. Despite this, the complaint has alleged that BART Watch's End User License Agreement and other access permissions pages do not seek consent from the user to collect and transmit this information. The plaintiff has alleged that these practices "are abnormal in the transit app industry and run contrary to California norms."
The named class action plaintiff, a user of BART Watch since 2016, has sought damages and injunctive relief in the form of compelling BART and Elerts to: (1) stop collecting unique user identification and location data, (2) purge their records of all existing data, and (3) inform the plaintiff and putative class members of parties who received access to the collected information.
Takeaway: In light of increased public awareness of the capturing of cellphone user data by app makers and controversial "stingray" trackers, developers of digital tools that collect user information should pay close attention to this suit. In particular, any rulings interpreting the California's 2015 Cellular Communications Interception Act may provide important guidance to companies collecting cell phone data.
This article is presented for informational purposes only and is not intended to constitute legal advice.
