https://ploum.nl/uploads/Artikelen_en_Track_Records_en_expertise/Privacy/communication-6605648_1920.jpg

Odido fined by Dutch supervisory authority for processing traffic data

08 Apr '24

Author(s): Lisanne Bruggeman & Nina Rijsterborgh-Witt

The processing of traffic and location data is widely used in practice. Under the GDPR, this requires a processing basis and especially since location data may be sensitive personal data, may require further appropriate safeguards. The Dutch Telecommunications Act contains specific rules on the use of traffic and location data in the electronic communications sector. On the basis of a recent fine imposed on Odido (formerly: T-Mobile), we tell you more about some points of attention when processing these data.

Fine Odido

Last month it was announced that the Dutch supervisory authority “Rijksinspectie Digitale Infrastructuur” ("RDI"), until recently known as “Agentschap Telecom”, imposed a fine of € 175,000 on Odido. Odido processed traffic data and estimated location data for the project "Pilot Mobile Phone Data". This project involved a collaboration with the Dutch agency for statistics “Centraal Bureau voor de Statistiek” ("CBS") to develop an algorithm. The algorithm could provide information about the movements of large groups of people. According to RDI's investigation, the processing of traffic data did not comply with the rules of the Dutch Telecommunications Act. The cause for the RDI's investigation was an article in the Dutch newspaper “NRC” about the cooperation between Odido and CBS.

The violation

It involves processing traffic data and estimated location data of at least 2.5 million subscribers and users of Odido in 2017 and 4.5 million in 2019. Instead of anonymizing this data immediately after it was no longer needed to transmit communications, Odido retained the data and further processed and enriched it. The processing of traffic data involved a purpose not mentioned in Article 11.5 of the Dutch Telecommunications Act. This article stipulates that telecom providers like Odido may process traffic data for the purposes listed in this article. For example, if it is necessary for preparing a bill for a subscriber. Or for market research or sales activities if the subscriber or user has given permission.

In this case, the purpose was to produce estimates of the number of people present in a neighborhood or municipality from the data for statistical data processing by CBS. Odido granted CBS employees access to pseudonymized traffic data as part of the cooperation. According to the RDI, there is no national law under which this (pseudonymized) traffic data may be processed for statistical purposes. The RDI found that the breach lasted almost 2 years, from the beginning of 2018 to the end of 2019.

GDPR

So what about the GDPR? The processing of traffic and location data often also involves the processing of "personal data". As a person's presence at a certain location, depending also on the context, can provide sensitive information and this can affect the person's privacy, it is always important to comply with the rules of the GDPR. In the case of Odido, it was held that the Dutch Telecommunications Act contains more specific - and in this case exhaustive - processing bases and purposes, so an assessment of the obligations under the GDPR did not arise. However, in other cases it may be important to:

  • Determine whether a processing basis exists (and seek consent if necessary);
  • Inform data subjects about data processing and their rights in this regard;
  • Implementing adequate security measures and establishing appropriate retention periods; and
  • Conduct a DPIA (data protection impact assessment), for example in the case of large-scale processing and/or systematic monitoring of location data.

As we have seen in the case of Odido, it is important to also assess whether other more specific rules apply.

Reduction of fine

Initially, the RDI had imposed a fine of € 400,000 on Odido. Odido objected to this. As a result of this objection, the fine was reduced to an amount of € 175,000. Odido has announced that it will not appeal this fine in court. Note: it may pay to act against imposed fines, in which case our privacy team is happy to help.

Need advice?

Does your organization process or plan to process traffic or location data? We would be happy to think along with you. Feel free to contact our privacy team. We are ready to advise you.

Contact

Attorney at law

Lisanne Bruggeman

Expertises:  Privacy law, IT-Law, Intellectual property rights, Contract law, Litigation,

Share this article

Stay up to date

Click on the plus and sign up for updates on this topic.

Expertise(s)

Met uw inschrijving blijft u op de hoogte van de laatste juridische ontwikkelingen op dit gebied. Vul hieronder uw gegevens in om per e-mail op te hoogte te blijven.

Personal data

 

Company details

For more information on how we use your personal information, please see our Privacy statement. You can change your preferences at any time via the 'Edit profile' link or unsubscribe via the 'Unsubscribe' link. You will find these links at the bottom of every message you receive from Ploum.

* This field is required

Interested in

Personal data

 

Company details

For more information on how we use your personal information, please see our Privacy statement. You can change your preferences at any time via the 'Edit profile' link or unsubscribe via the 'Unsubscribe' link. You will find these links at the bottom of every message you receive from Ploum.

* This field is required

Interested in

Create account

Get all your tailored information with a My Ploum account. Arranged within a minute.

I already have an account

Benefits of My Ploum

  • Follow what you find interesting
  • Get recommendations based on your interests

*This field is required

I already have an account

Benefits of My Ploum

Follow what you find interesting

Receive recommendations based on your interests

{phrase:advantage_3}

{phrase:advantage_4}


Why do we need your name?

We ask for your first name and last name so we can use this information when you register for a Ploum event or a Ploum academy.

Password

A password will automatically be created for you. As soon as your account has been created you will receive this password in a welcome e-mail. You can use it to log in immediately. If you wish, you can also change this password yourself via the password forgotten function.