D11.3: Economic aspects of mobility and identity

Title: INTRODUCTION

Introduction

In the advent of the mobile revolution, identity is facing great challenges. Mobility has freed the subscriber or the user of a service from a specific space, rendering it unclear not only who the person initiating a communication is, but also where this person is located and how many ways he has in order to express a communication. The volume of data generated and processed has proliferated, giving rise to new privacy threats. There is an increasing number of situations in which the user is either not aware that his personal data is collected or his system unlawfully accessed or he chooses to sacrifice it in return for other benefits.

‘Data processing’ is defined as “any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction”. It follows that the definition of processing is extraordinarily broad, so that it is difficult to conceive any operation performed on personal data which would not be covered by it. It is important to note that mere storage of personal data by the providers of publicly available electronic communications services or of a public communications network constitutes ‘data processing’, so that simply storing data on a server or other medium is deemed to be processing, even if nothing else is being done with it.

The broad definition of data processing can lead to uncertainty as to what can be included under processing when it comes to mobility and new technologies. The European Court of Justice has ruled that “the act of referring, on an internet page, to various persons and identifying them by name or by other means, for instance by giving their telephone number or information regarding their working conditions and hobbies, constitutes the processing of personal data wholly or partly by automatic means within the meaning of Article 3(1) of Directive 95/46”. Such a broad interpretation of ‘data processing’ can expand the meaning in the field of mobile communications, imposing extensive obligations on the service providers.