Do London’s trash cans know too much?

London's "smart bins" have stopped logging cellphone data via wireless connections at 12 locations after a report by Quartz raised concerns from the city and a privacy advocacy group last week.

The recycling bins, built by startup company Renew and installed ahead of the 2012 Olympics, were recently outfitted with technology that could identify nearby phone and internet-connected devices.

The plan was to use the capability to collect consumer data, mostly around the Cheapside area of central London, and sell it to other companies for targeted advertisements, though charities and the city would also be allotted airtime on the bins' LCD screens. 

Renew chief executive Kaveh Memari said in an open letter that the bins, which he called "glorified people-counters," only recorded "extremely limited, encrypted, aggregated and anonymized data." He compared them to traffic monitors used by many websites. 

Still, the City of London Corporation, the city's municipal governing body, asked Renew to halt operations.

“We have already asked the firm concerned to stop this data collection immediately. We have also taken the issue to the Information Commissioner’s Office. Irrespective of what’s technically possible, anything that happens like this on the streets needs to be done carefully, with the backing of an informed public.”

This graph, taken from Renew, illustrates how many devices were identified on a high-traffic day, with dips between usual rush hours. The data could allow Renew or another company to know where a device goes and when, and which stores people typically visit. Renew has picked up about a million unique divices so far from the recylcling bin monitors.

Nick Pickles, director of Big Brother Watch, a UK-based privacy and civil liberties advocacy group, issued a statement responding to the decision to halt the program:

"I am pleased the City of London has called a halt to this scheme, but questions need to be asked about how such a blatant attack on people's privacy was able to occur in the first place," he said. 

"Systems like this highlight how technology has made tracking us much easier, and in the rush to generate data and revenue there is not enough of a deterrent for people to stop and ensure that people are asked to give their consent before any data is collected," he added.

The legality of the operation remains unclear. According to the Financial Times, who spoke with Niri Shan, head of media at the law firm Taylor Wessing, the bins had "likely breached both privacy law and the data protection act." 

European Union Directive 2009/136/EC, a law on electronic and communication rights, states:

“Member States shall ensure that the storing of information … in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned has given his or her consent.”

The law relates to websites that store cookies, which can be installed on a device to monitor user habits. But Renew may have found a way around using cookies, since it reportedly only checks the media access control (MAC), a unique identifier that most electronic devices have.

As the BBC points out:

"Websites or companies wanting to use cookies to tracks users' habits have to ask for permission. By monitoring MAC addresses, which just keeps a log of each time a wi-fi enabled device connects to another device, [Renew] can work around this requirement."