Rotation of asset ID after rental

[ewooonk]

Is your feature request related to a problem? Please describe.

The current spec of ​/operator​/available-assets allows to derive individual trips of similar vehicles using the vehicle ID.

Urgency

Major, because publishing individual trips is not in accordance with GDPR regulations.

Additional context

MobilityData/gbfs#147

Describe the solution you'd like

Rotate the vehicle ID after every trip.

Describe alternatives you've considered

• Hide the vehicles for a random time period after the end of rental.

Possible Implementation

See GBFS 2.0.

[edwinvandenbelt]

The TOMP API DOESN'T publish individual trips. But the available-assets could be used to expose asset-locations and thereby can be in conflict with the GDPR.

It should be implemented as follows: the returned objects are collections of assets, including a number of available assets. Not the assets themselves.

Only when a TO wants to publish locations of assets, the assets can be added. If there are snapshots taken from TOs that implemented this endpoint in this way, it might be possible to track people. So I agree with you, I'll add some comment in de swagger file and add a paragraph with this topic in the Wiki.