The Dutch Data Protection Authority (AP) has fined Enschede 600,000 euros because the municipality used WiFi tracking in the city center in a way that is not allowed. With WiFi tracking people can be followed.
The use of WiFi tracking is subject to strict requirements and in most cases prohibited, the AP says .
In 2017, the municipality of Enschede decided to measure the traffic in the city center using sensors. The municipality hired a company that specializes in counting passers-by. Measuring boxes in the shopping streets picked up the WiFi signals from the mobile phones of people passing by. Everyone’s phone was registered separately, with a unique code.
From counting to tracking
By counting how many telephones there are at any given time around a measuring box, you know how busy it is. But if you keep track of which phone passes which measuring box over a longer period of time, this ‘counting’ changes into tracking people, says the AP. And that was the case in Enschede. The privacy of citizens was not properly guaranteed, because they could be tracked without this being necessary.
Violation of privacy law
According to the privacy watchdog, it was not the intention of the municipality to monitor individuals and the AP has also found no indications that this has happened. But deploying WiFi tracking, which makes this possible, is in itself a serious violation of the GDPR privacy law. “It is not intended that anyone can track which shop, doctor, church or mosque we visit. That is private and it must remain private. So that people can be themselves without feeling inhibited by possible registration,” said AP vice president. Monique Verdier. “A municipality must put this fundamental right of its residents first.”
The violation started in May 2018. The intervention of the AP prompted the municipality to stop Wi-Fi tracking on May 1, 2020.
The municipality of Enschede has lodged an objection against the fine. The municipality argues that the counts are anonymous and that no personal data has been processed. And the AP is based on a purely theoretical scenario, according to the municipality. “We feel unjustly punished for something that we did not intend and which actually did not happen”, says mayor Onno van Veldhuizen of Enschede. “Safeguarding the privacy of our inner city visitors has been a condition from the start.”