Odido fined by Dutch supervisory authority for processing traffic data

Fine Odido

Last month it was announced that the Dutch supervisory authority “Rijksinspectie Digitale Infrastructuur” ("RDI"), until recently known as “Agentschap Telecom”, imposed a fine of € 175,000 on Odido. Odido processed traffic data and estimated location data for the project "Pilot Mobile Phone Data". This project involved a collaboration with the Dutch agency for statistics “Centraal Bureau voor de Statistiek” ("CBS") to develop an algorithm. The algorithm could provide information about the movements of large groups of people. According to RDI's investigation, the processing of traffic data did not comply with the rules of the Dutch Telecommunications Act. The cause for the RDI's investigation was an article in the Dutch newspaper “NRC” about the cooperation between Odido and CBS.

The violation

It involves processing traffic data and estimated location data of at least 2.5 million subscribers and users of Odido in 2017 and 4.5 million in 2019. Instead of anonymizing this data immediately after it was no longer needed to transmit communications, Odido retained the data and further processed and enriched it. The processing of traffic data involved a purpose not mentioned in Article 11.5 of the Dutch Telecommunications Act. This article stipulates that telecom providers like Odido may process traffic data for the purposes listed in this article. For example, if it is necessary for preparing a bill for a subscriber. Or for market research or sales activities if the subscriber or user has given permission.

In this case, the purpose was to produce estimates of the number of people present in a neighborhood or municipality from the data for statistical data processing by CBS. Odido granted CBS employees access to pseudonymized traffic data as part of the cooperation. According to the RDI, there is no national law under which this (pseudonymized) traffic data may be processed for statistical purposes. The RDI found that the breach lasted almost 2 years, from the beginning of 2018 to the end of 2019.

GDPR

So what about the GDPR? The processing of traffic and location data often also involves the processing of "personal data". As a person's presence at a certain location, depending also on the context, can provide sensitive information and this can affect the person's privacy, it is always important to comply with the rules of the GDPR. In the case of Odido, it was held that the Dutch Telecommunications Act contains more specific - and in this case exhaustive - processing bases and purposes, so an assessment of the obligations under the GDPR did not arise. However, in other cases it may be important to:

• Determine whether a processing basis exists (and seek consent if necessary);
• Inform data subjects about data processing and their rights in this regard;
• Implementing adequate security measures and establishing appropriate retention periods; and
• Conduct a DPIA (data protection impact assessment), for example in the case of large-scale processing and/or systematic monitoring of location data.

As we have seen in the case of Odido, it is important to also assess whether other more specific rules apply.

Reduction of fine

Initially, the RDI had imposed a fine of € 400,000 on Odido. Odido objected to this. As a result of this objection, the fine was reduced to an amount of € 175,000. Odido has announced that it will not appeal this fine in court. Note: it may pay to act against imposed fines, in which case our privacy team is happy to help.

Need advice?

Does your organization process or plan to process traffic or location data? We would be happy to think along with you. Feel free to contact our privacy team. We are ready to advise you.