Geo-location Services on Mobiles – What Privacy Issues?

• geo-location data: geo-location data are “personal data” for the purposes of the EU Privacy Directive 95/46 as it is possible to indirectly identify the person whom they refer to and consequently the processing of such data has to comply with the obligations prescribed by applicable data protection laws;
• entities subject to privacy obligations: the controllers of geo-location data obliged to  comply with data protection obligations are the controllers of geo-location infrastructure, the providers of geo-location application and services and the developer of the operating system;
• privacy information notice and prior consent: the processing of geo-location data requires that customers (i) are provided with a privacy information notice containing all the information required by applicable privacy law and (ii) give their prior consent. In particular, on this second matter the WP stressed that the consent has to be specific for the different purposes for which they are processed i.e. a broad consent covering all the purposes for which data are processed would not be sufficient;
• individuals rights: customers should be provided with the possibility to access to their geo-location data and profile created by the data controller, to erase, update and rectify their data; and
• deletion of geo-location data: geo-location data need to be deleted or made anonymous as soon as they are no longer necessary for the purposes for which they were initially collected.  Unique identifiers (such as MAC addresses) should only be stored for a maximum period of 24 hours, and should subsequently be deleted or anonymized.

Privacy issues relating to geo-location data are a currently a very hot topic in Italy after that the Italian Data Protection Authority has started an investigation on the compliance with Italian privacy law of the collection of geo-location data through Apple iPads and iPhones.