Spain, Austria not convinced location data is personal information
(2022/06/22)
- Reference: 1655882771
- News link: https://www.theregister.co.uk/2022/06/22/spain_austria_notb_location/
- Source link:
Some authorities in Europe insist that location data is not personal data as defined by the EU's General Data Protection Regulation.
EU privacy group NOYB (None of your business), set up by privacy warrior Max " [1]Angry Austrian " Schrems, said on Tuesday it appealed a decision of the Spanish Data Protection Authority (AEPD) to support Virgin Telco's refusal to provide the location data it has stored about a customer.
In Spain, according to NOYB, the government still requires telcos to record the metadata of phone calls, text messages, and cell tower connections, despite Court of Justice (CJEU) decisions that prohibit data retention.
[2]
A Spanish customer demanded that Virgin reveal his personal data, as allowed under the GDPR. Article 15 of the [3]GDPR guarantees individuals the right to obtain their personal data from companies that process and store it.
[4]
[5]
"Personal data is any information that relates to an identified or identifiable living individual," [6]as defined by the EU . "Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data."
The EU example specifically cites "location data" as an example, though other regulations like the ePrivacy Directive allow limited circumstances when location data may be anonymized – which can [7]still pose privacy problems – and considered non-personal data or disclosed to authorities.
[8]
Virgin, however, refused to provide the customer's location data when a complaint was filed in December 2021, arguing that only law enforcement authorities may demand that information. And the AEPD sided with the company.
NOYB says that Virgin Telco failed to explain why Article 15 should not apply since the law contains no such limitation.
[9]Campaigners warn of legal challenge against Privacy Shield enhancements
[10]Lawyers say changes to UK data law will make life harder for international businesses
[11]Europe's GDPR coincides with dramatic drop in Android apps
[12]Google chases sovereignty market with EU Workspace Data product
"The fundamental right to access is comprehensive and clear: users are entitled to know what data a company collects and processes about them – including location data," argued Felix Mikolasch, a data protection attorney at NOYB, in [13]a statement . "This is independent from the right of authorities to access such data. In this case, there is no relevant exception from the right to access."
NOYB has taken its appeal to the Audiencia Nacional, Spain's national court. The group said it filed a similar appeal last November in Austria, where that country's data protection authority similarly supported Austrian mobile provider A1's refusal to turn over customer location data. In that case, A1's argument was that location data should not be considered personal data [14]because someone else could have used the subscriber phone that generated it.
Location data is potentially [15]worth billions . According to Fortune Business Insights, the [16]location analytics market is expected to bring in $15.76 billion in 2022 and $43.97 billion by 2029.
[17]
Outside the EU, the problem is the availability of location data, rather than lack of access. In the US, where there's [18]no federal data protection framework , the government is a [19]major buyer of location data – it's more convenient than getting a warrant.
And companies that can obtain location data, often through mobile app SDKs, appear keen to monetize it.
In 2020, the FCC [20]fined the four largest wireless carriers in the US for failing to protect customer location data in accordance with a 2018 commitment to do so. ®
Get our [21]Tech Resources
[1] https://www.theregister.com/2015/09/08/european_court_of_justice_advisor_bot_safe_harbour/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YrLoSCfHJyFGlNB3qjITCgAAAJY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YrLoSCfHJyFGlNB3qjITCgAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YrLoSCfHJyFGlNB3qjITCgAAAJY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en
[7] https://twitter.com/random_walker/status/959884292141867008?s=20
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YrLoSCfHJyFGlNB3qjITCgAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2022/05/26/privacy_shield_schrems_warning/
[10] https://www.theregister.com/2022/05/16/brexit_data_law/
[11] https://www.theregister.com/2022/05/09/gdpr_europe_apps/
[12] https://www.theregister.com/2022/05/05/google_eu_sovereign/
[13] https://noyb.eu/en/noyb-files-appeal-against-spanish-dpa
[14] https://noyb.eu/en/cell-phone-data-not-personal-noyb-appeals-federal-administrative-court
[15] https://themarkup.org/privacy/2021/09/30/theres-a-multibillion-dollar-market-for-your-phones-location-data
[16] https://www.globenewswire.com/en/news-release/2022/04/12/2420786/0/en/With-15-8-CAGR-Location-Analytics-Market-Size-Worth-USD-43-97-Billion-in-2029.html
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YrLoSCfHJyFGlNB3qjITCgAAAJY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[18] https://www.theregister.com/2022/06/15/federal_data_privacy/
[19] https://www.eff.org/deeplinks/2022/06/how-federal-government-buys-our-cell-phone-location-data
[20] https://www.fcc.gov/document/fcc-proposes-over-200m-fines-wireless-location-data-violations
[21] https://whitepapers.theregister.com/
EU privacy group NOYB (None of your business), set up by privacy warrior Max " [1]Angry Austrian " Schrems, said on Tuesday it appealed a decision of the Spanish Data Protection Authority (AEPD) to support Virgin Telco's refusal to provide the location data it has stored about a customer.
In Spain, according to NOYB, the government still requires telcos to record the metadata of phone calls, text messages, and cell tower connections, despite Court of Justice (CJEU) decisions that prohibit data retention.
[2]
A Spanish customer demanded that Virgin reveal his personal data, as allowed under the GDPR. Article 15 of the [3]GDPR guarantees individuals the right to obtain their personal data from companies that process and store it.
[4]
[5]
"Personal data is any information that relates to an identified or identifiable living individual," [6]as defined by the EU . "Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data."
The EU example specifically cites "location data" as an example, though other regulations like the ePrivacy Directive allow limited circumstances when location data may be anonymized – which can [7]still pose privacy problems – and considered non-personal data or disclosed to authorities.
[8]
Virgin, however, refused to provide the customer's location data when a complaint was filed in December 2021, arguing that only law enforcement authorities may demand that information. And the AEPD sided with the company.
NOYB says that Virgin Telco failed to explain why Article 15 should not apply since the law contains no such limitation.
[9]Campaigners warn of legal challenge against Privacy Shield enhancements
[10]Lawyers say changes to UK data law will make life harder for international businesses
[11]Europe's GDPR coincides with dramatic drop in Android apps
[12]Google chases sovereignty market with EU Workspace Data product
"The fundamental right to access is comprehensive and clear: users are entitled to know what data a company collects and processes about them – including location data," argued Felix Mikolasch, a data protection attorney at NOYB, in [13]a statement . "This is independent from the right of authorities to access such data. In this case, there is no relevant exception from the right to access."
NOYB has taken its appeal to the Audiencia Nacional, Spain's national court. The group said it filed a similar appeal last November in Austria, where that country's data protection authority similarly supported Austrian mobile provider A1's refusal to turn over customer location data. In that case, A1's argument was that location data should not be considered personal data [14]because someone else could have used the subscriber phone that generated it.
Location data is potentially [15]worth billions . According to Fortune Business Insights, the [16]location analytics market is expected to bring in $15.76 billion in 2022 and $43.97 billion by 2029.
[17]
Outside the EU, the problem is the availability of location data, rather than lack of access. In the US, where there's [18]no federal data protection framework , the government is a [19]major buyer of location data – it's more convenient than getting a warrant.
And companies that can obtain location data, often through mobile app SDKs, appear keen to monetize it.
In 2020, the FCC [20]fined the four largest wireless carriers in the US for failing to protect customer location data in accordance with a 2018 commitment to do so. ®
Get our [21]Tech Resources
[1] https://www.theregister.com/2015/09/08/european_court_of_justice_advisor_bot_safe_harbour/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YrLoSCfHJyFGlNB3qjITCgAAAJY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YrLoSCfHJyFGlNB3qjITCgAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YrLoSCfHJyFGlNB3qjITCgAAAJY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en
[7] https://twitter.com/random_walker/status/959884292141867008?s=20
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YrLoSCfHJyFGlNB3qjITCgAAAJY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2022/05/26/privacy_shield_schrems_warning/
[10] https://www.theregister.com/2022/05/16/brexit_data_law/
[11] https://www.theregister.com/2022/05/09/gdpr_europe_apps/
[12] https://www.theregister.com/2022/05/05/google_eu_sovereign/
[13] https://noyb.eu/en/noyb-files-appeal-against-spanish-dpa
[14] https://noyb.eu/en/cell-phone-data-not-personal-noyb-appeals-federal-administrative-court
[15] https://themarkup.org/privacy/2021/09/30/theres-a-multibillion-dollar-market-for-your-phones-location-data
[16] https://www.globenewswire.com/en/news-release/2022/04/12/2420786/0/en/With-15-8-CAGR-Location-Analytics-Market-Size-Worth-USD-43-97-Billion-in-2029.html
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YrLoSCfHJyFGlNB3qjITCgAAAJY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[18] https://www.theregister.com/2022/06/15/federal_data_privacy/
[19] https://www.eff.org/deeplinks/2022/06/how-federal-government-buys-our-cell-phone-location-data
[20] https://www.fcc.gov/document/fcc-proposes-over-200m-fines-wireless-location-data-violations
[21] https://whitepapers.theregister.com/
Re: Start to publish politicians, judges and other "VIP" location data...
Tom 7
They tend to have exclusions to various things - cant have people in a democracy talking to politicians!
It is personal
hoola
The trouble is that as soon as you start to make exceptions it becomes too easy to aggregate other bits of data that are also not seen as personal to create a very accurate profile.
Location data is going to be one of the main tools in joining up the dots.
Hm, I'd say..
Piro
.. That knowledge of a person's whereabouts at any time is some of the most personal data.
Re: Hm, I'd say..
Neil Barnes
I would agree. But the meat of the judgement seems to equate 'someone else could have used the phone' with 'therefore it's *not* personal data any more'.
Re: Hm, I'd say..
Mike 137
" But the meat of the judgement seems to equate 'someone else could have used the phone' "
Objectively, records of those instances where the data subject did use the phone are that data subject's personal data and are therefore subject to disclosure. The duty (if any) of unscrambling which location records pertain devolves on the data controller, and 'inconvenience' of doing so would not be a get-out. Furthermore, in any case where the location records are aggregated with other personal data (e.g. phone contract data) those records become personal data by virtue of the aggregation.
'Someone else could have used the phone' therefore looks very like an excuse to circumvent the legislation (such a common phenomenon that the GDPR has become in many ways ineffective as a protection of data subject rights).
Re: Hm, I'd say..
Pascal Monett
Agreed, but if you want your mobile phone to be useful, the telco has to know which tower can contact you.
This is going to be a thorny problem.
Go Max, Go!
Potemkine!
We need more people like you.
Start to publish politicians, judges and other "VIP" location data...
... and just see how they immediately become Very Personal Data.