Interpretation of Location data and Traffic data - only in context of ePrivacy?

[pendzel]

Question

Should we treat GPS data computed on IoT devices automaticly as Privacy Asset / Personal Information?

Would you say that this checklist is somehow valid?

1. It’s linked to a person (owner/account/user) ⇒Personal data
2. You use network/service-derived location (cell-ID, triangulation, operator location APIs/records) ⇒ Location data
3. You store or analyse communications metadata (conveyance/billing logs, connection times/byte counts) ⇒ Traffic data

My current personal position

Note

The explicit linkage of definitions for Location data and Traffic data in RED Delegated Act to ePrivacy Directive is a critical detail. So we should interpret this within context and purpose of ePrivacy, not standalone description.

As Eg lets take "LTE Dog Tracker" device.

Is "Dog Location" Personal Data? -> No

Is this data can be categorized as Personal Data according to GDPR . No because i cannot link this data with any natural person.
In my opinion if some gps data can identify a natural person then it should be categorized as Personal Data (GDPR) not seperete category of Location Data.

is "Dog Location" Location Data -> No

As mention above "Dog Location" should be analysed in context of ePrivacy directive, it should not become Location Data only because it conatin word "location" init. "Dog Location" data from ePrivacy directive is treated as any other application data/sensor data.

"Dog Location" data is computed on device itself not network or service derived(eg cell tower triangulation, IP adresses etc).

is "LTE Tracker" processig traffic data -> No

Tracker does not process ePrivacy traffic data, device does not create, retain, or analyze communications metadata used for the "conveyance or billing of communications", such metadata is generated and processed by the mobile operator.Tracker only 'touches' protocol headers transiently to send its application payload and does not receive operator traffic records

[zealience]

Hi @pendzel ,
Thank you for sharing your checklist on this topic.

I agree with your depiction that personal data, location data and traffic data are a subset of personal information. EN 18031 defines personal data, location data and traffic data by referring to their respective directive (GDPR, ePrivacy). Hence, these types of data are only relevant for the RED DA/EN 18031 when they relate to a person.

In this context, to answer your questions: Should we treat GPS data computed on IoT devices automaticly as Privacy Asset / Personal Information?
→ No, I would not consider all location data as privacy asset, but only the one relating to a person or which can relate to a person.

Example 1: A Bluetooth beacon collects the GPS position of an item (eg, cargo, hospital beds). As long as this data cannot be traced back to a person, this should not be considered personal information in my opinion. The GPS position does not need to be documented as privacy asset (and most importantly, no EN 18031 requirements apply to this data).

Example 2: The dog tracker is a tricky case. In my opinion, this could arguably be considered actually personal information because the location data of the dog can easily infer the location of the owner (especially when other data about the owner is collected). Moreover, the patterns of the GPS data can hint the lifestyle patterns of the owner (eg, where does the owner live, when he/she goes out to walk the dog, where, etc.). The question would also be "what other data is processed"? Assuming that the owner had to register the device by creating an account with his/her name, email address, etc., the location data of the dog can be considered personal information. Therefore, the GPS position of the dog may be classified as location data/personal information/privacy asset. This would have to be clarified in a risk assessment.

[Edit] In my opinion, this example is somewhat similar to the case of smart meters. At first glance, no personal information information is collected. However, "power data usage patterns obtained from smart meters can reveal much more than how much power is being used: the use of household appliances is an indicator of human behaviour, and allows for the identification of individuals. The operation of smart meters therefore entails the processing of ‘personal data’ and needs to be in line with the EU’s GDPR." (European Data Protection Supervisor)

Tip

I would recommend the following steps when conducting a risk assessment in the context of EN 18031 (when focusing on personal information, it is often referred to as a "privacy impact assessment"):

1. List out all the data processed (collected, transmitted, stored)
2. For each data, identify whether it can relate to a person (i.e. personal information)
3. For each data, classify it: Sensitive or Sensitive & Confidential (we discuss such classification in our article on Privacy assets)
   This risk assessment is essential to ensure the "legal defensibility" of a manufacturer's technical documentation and cybersecurity measures implemented. In case a Market Surveillance Authority asks questions, this will ensure to have all evidence and rationale properly captured,

Regarding traffic data, I fully agree with you that the LTE tracker would not process any of such data. As you said, it is important to consider traffic data in the context of the ePrivacy directive. In my opinion, most end-point equipment (like this tracker) would not process traffic data, but rather network equipment (eg, deployed by ISPs).

I hope this answers your questions.
Thanks again for sharing your insights and views on this topic!

Guillaume