Dutch DPA
- Country
- Netherlands
- Fine
- 600,000 EUR
- Date
- 2021-04-29
- Sector
- Public Sector
- Articles
- Art. 5(1)(a) jo.Art. 6(1) GDPR
Using wifitracking without any legal basis by a town/municipality but to follow shoppers and people who live or work in the city center.
The Dutch Data Protection Authority (AP) has decided to impose an administrative fine of € 600,000 on the Municipal Executive of Enschede. The Municipal Executive of Enschede has processed personal data of owners/users of mobile devices with Wi-Fi turned on in the city center of Enschede without any legal basis. There are sensors in the city center of Enschede that collect data from those people walking by who have turned on the Wi-Fi on their phone.
Additional information
The AP concludes that the combination of MAC address and location data and<br />the combination of pseudonymised MAC address and location data on the sensor from May 25, 2018 to April 30, 2020 and in the short-term and long-term table until January 1, 2019 qualify as personal data within the meaning of the GDPR.