On 22 February 2017, the FDPIC announced that it had concluded the proceedings against Valora in the matter of people tracking. You can find the corresponding notice here.
Background: In December 2016, it became publicly known that Valora was collecting mobile data from its customers in its kiosk branches in order to use this data for personalized advertising. In the meantime, however, Valora had explained to the FDPIC in a written statement that it does not process any personal data, but only evaluates aggregated data for statistical purposes. Valora had also agreed to provide more detailed information about the project on its website.
In this context, we would like to remind you of the information provided by the FDPIC on the data protection aspects that must be taken into account when using personal tracking systems:
People tracking involves tracking the movements of objects or people. Person tracking systems record certain characteristics of the passing objects or persons at a location with a lot of public traffic (e.g. shopping mall or highway entrance) in such a way that the system can recognize them at certain checkpoints and thus track their movements.
The FDPIC notes that the scope of the Data Protection Act is not limited to tracking systems that record direct personal characteristics (e.g., facial or license plate recognition). Rather, the Data Protection Act also covers tracking systems that record mobile phone data under certain circumstances:
In the case of these systems, it has been argued on various occasions that no personal data is collected, which is why the Data Protection Act does not apply.
However, this view does not go far enough: It is true that the operators of such systems are not yet able to assign IMSI and TMSI numbers or Mac addresses directly to a specific person. However, this may be possible under certain circumstances in the case of the movement profiles that are created. For example, the movement profiles of sales staff in a retail store differ from those of customers. In the case of smaller stores, this means that a movement profile can quickly be assigned to a specific employee. But also by linking the collected data and the created profiles with further data (e.g. the images from surveillance cameras or payment data), an allocation can become possible. It must therefore also be assumed that these systems are processing personal data within the meaning of the Data Protection Act.
From this, the FDPIC concludes that the use of personal tracking systems always requires a justification.
- The FDPIC points out the practical difficulties of obtaining effective consent.
- The FDPIC considers an overriding public interest to exist where person tracking is carried out for non-personal purposes (for example, to improve security at airports or to avoid traffic jams).
- The private interest in the delivery of customized advertising is not recognized by the FDPIC as a justification.
The FDPIC’s information on personal tracking can be found at here.