Resources
- Identity Use Cases & Scenarios.
- FIDIS Deliverables.
- IDIS Journal.
- FIDIS Interactive.
- Press & Events.
- In-House Journal.
- Booklets
- Identity in a Networked World.
- Identity R/Evolution.
D11.3: Economic aspects of mobility and identity
Location Based Services
Besides the general provisions regulating consent in relation to data protection, the ePrivacy directive includes a specific provision regarding value-added services based on location data, i.e. Location Based Services (LBS). Location data other than traffic data of the user or the subscriber may only be processed when they are made anonymous. Otherwise the user or the subscriber needs to give his consent before the processing of location data, after being informed about the terms of such processing and the possibility to withdraw his consent for the processing of location data other than traffic data at any time . According to an Opinion of the Article 29 Working Party on the use of location data with a view to providing value-added services, ‘the subject of location data to be processed needs to be informed about the identity of the controller (and/or of his representative), the purposes of processing, the type of location data processed, the duration of processing, whether the data will be transmitted to a third party for the purpose of providing the value-added service, the right of access and the right to rectify the data, the right of users or subscribers to withdraw their consent at any time or temporarily refuse the processing of such data, and the conditions on which this right may be exercised and the right to cancel the data’. In case a service requires the automatic location of an individual, the user shall be given full information in advance about the processing of their location data and calling the relevant number shall amount to consenting to being located.
The information shall be provided by the party collecting the location data for processing and thus by the provider of the value added service, or if this is not possible by the electronic communications operator. The information could be provided either directly each time the service is used or in the general terms and conditions for the value-added service. In the latter case the service provider should make the information available such that the individuals concerned can consult it again at any time and by a simple method, such as via a website or while using the service (e.g. by telephoning a dedicated number). In addition, in cases of ongoing processing of location data the individual shall be regularly reminded about the processing of his location data.
A closer look to this article reveals a problem of interpretation regarding the consent of the data subject within the context of LBS. Ambiguousness arises with regard to the actual person whose consent is needed. When the user and the subscriber is the same person then the situation is clear. In electronic communications though it is rather common that one person is the subscriber and another one is the user of a device. In this case special attention should be drawn to the relation between these two. Usually, the person to whom the location data relate shall be the one who gives his consent. In the example of enterprise services the employer is the subscriber, while the employee is the user. Respect to data protection principles would suggest that the person whose consent is needed for the processing of location data is the employee (user).
A different situation is the purchase of an end user device by a parent for his under-aged child. Usually parents do so as an easy way to be able to track their children. Most possibly the answer to our question will be different from the one given in the example of the enterprise services. In the general framework of the protection of minors, the subscriber, who is in this case the parent or guardian, and not the user, shall be the one to give his consent, taking into consideration the national legislation regarding the age of the minors.
15 / 37 |