D11.6: Survey on Mobile Identity

The legal framework for LBS in Europe CONCLUSION

Conclusion

The legal provisions covering the use of location data in Germany are complex and cover the Telecommunications Act, the Telemedia Act and the Federal Data Protection Act. Directive 2002/58/EC was transposed into national law by amending the Telecommunications Act.  

The following figure presents the steps of data processing which occur during the provision of a LBS: 

Figure : Processing of location data and legal bases

While it has been argued that as consent is obligatory at the stage of collection of location data by the telecommunications provider, the lack of a second obligation to obtain consent for the content provider does not lever out the right to informational self-determination, this view has been questioned. A reactive LBS needs to be initiated by an explicit request of a service each time it is needed. This is not the case for a proactive LBS which, if requested once, may lead to permanent monitoring of the cell phone location. Considering the above illustrated requirements, the following gap is apparent: the person originally requesting the LBS and the later user of the cell phone can be two different persons. For example an employer could issue cell phones to all employees or a wife could let her husband use a cell phone she subscribed for. The subscriber (or a different person who secretly uses the phone for a short period of time) or the user can request localisation of the cell phone without the other parties’ knowledge and consent to the localisation at “step 2” (transmission of location data to content provider for provision of LBS). Information must be provided at the beginning of the use on the kind of data collected and used, the scope of data collected and used and purpose of data collection and use. But if the requested location based service is a proactive service, localisation spans long periods of time.  

Many content providers do not repeatedly send information on the aforementioned indications in irregular intervals and misuse is therefore possible. A regularly obtained consent for proactive location based services would reduce the lack of transparency, at least regular notification should be mandatory. 

For public parties, especially law enforcement authorities, location data is of substantial interest when investigating into criminal acts. While some provisions allow for the generation of location data by public authorities, statutes also allow access to location data available at private parties. Access to precise location data collected and processed by Telecommunications Service Providers and Content Providers (see 2.2.1) is not possible for public parties as it must be deleted when no longer necessary for the provision of the LBS. Traffic related location data on the other hand is treated as traffic data and will following the transposition of the data retention directive be stored for 6 months. For conclusions on preferences, this information can be sufficient. If linked with further traffic data, social networks can be determined. 

8 Location Information from a Dutch Perspective 

Colette Cuijpers, Bert-Jaap Koops & Arnold Roosendaal (TILT)