| Argentina | Belgium | Canada | France | Germany | Israel | Italy | Luxembourg | Mexico | Morocco | Norway | South Africa | Spain | Switzerland | Tunisia | United Kingdom | USA HERE, THERE AND EVERYWHERE i.e. MOBILITY DATA UNDER EU LEGISLATION Raffaele ZALLONE

Four «freedoms» are at the basis of E.U.: free circulation of goods, services, capitals, people Directive 95/46/EC on protection of..personal data «and on the free movement of such data» HERE, THERE AND EVERYWHERE i.e. MOBILITY DATA UNDER EU LEGISLATION

Mobility data : ? ? ? No definition in the law Directive 2002/58/EC only defines “Location data” Location data is a static concept, while mobility data implies the concept of movement HERE, THERE AND EVERYWHERE i.e. MOBILITY DATA UNDER EU LEGISLATION

Mobility can be related to: - The physical movement of a person in space and time (e.g. credit card data, airline data) - The physical movement of a device (e.g: RFID’s, mobile phones, tablets, etc) univocally linked to a person - The movement of personal information on a network or within an IT infrastructure (e.g.: Internet browsing data, cloud computing) HERE, THERE AND EVERYWHERE i.e. MOBILITY DATA UNDER EU LEGISLATION

The data protection principles of EU Law: - Personal data must be processed for specific purposes and processed in a way compatible with such purposes (the purposes and the transaparency principles) - Personal data must be adequate, relevant and not excessive (quality principle) - Personal Data can be transferred only to countries providing adequate protection (location principle) HERE, THERE AND EVERYWHERE i.e. MOBILITY DATA UNDER EU LEGISLATION

Mobility Data in EU – W.P. Article 29 RFID’s: W.P. 105 of January 19, 2005 Location data in VAS: W.P. 115 of November 25, 2005 Geo-location services on smartphones: W.P. 185 of May 16, 2011 HERE, THERE AND EVERYWHERE i.e. MOBILITY DATA UNDER EU LEGISLATION

RFID’s : the data principles must be complied with Controllers must check that data being processed comply with quality principles If products are sold with imbedded RFID’s, at check out consumers must have the possibility to have them removed HERE, THERE AND EVERYWHERE i.e. MOBILITY DATA UNDER EU LEGISLATION

W.P. 115 ON LOCATION DATA First EU documento to address smartphones Traffic data: necessary to supply the services. No consent required Other data: consent required “when processing sensitive data” Open issue: is consent required when not processing sensitive data? HERE, THERE AND EVERYWHERE i.e. MOBILITY DATA UNDER EU LEGISLATION

W.P. 185 ON GEOLOCATION SERVICES OFFERED ON SMART MOBILE DEVICES Privacy risks: geo-location services: -may give “on intimate overview of habits and patterns” and -may reveal sensitive data when reveals “visits to hospital and/or religious places” -Allows constant monitoring, that could be done without informing the data subject -Risks of theft, burglary, physical aggression, stalking HERE, THERE AND EVERYWHERE i.e. MOBILITY DATA UNDER EU LEGISLATION

Controllers: application providers, telecom operators, developers of operating system Legitimate grounds for processing: informed consent, specific and updated, with emphasis on unexpected purposes (behavioral mktg) Data subject right Retention period HERE, THERE AND EVERYWHERE i.e. MOBILITY DATA UNDER EU LEGISLATION

From theory to practice ITALY Geo-location processing of buses allowed, even if potential control of bus drivers was possible (June 5, 2008) Geo-location processing on the part of Alpine Rescue organizations (Dec. 19, 2008) HERE, THERE AND EVERYWHERE i.e. MOBILITY DATA UNDER EU LEGISLATION

The Netherlands Tom-Tom navigation system – Dec Processed personal data and passed them to third parties (police, but also commercial parties) Tom-Tom has undertaken to require consent by Feb Only anonymous and aggregate data to third parties: no violation of Law HERE, THERE AND EVERYWHERE i.e. MOBILITY DATA UNDER EU LEGISLATION

CONCLUSIONS So far limited attention but interest raising Proposed EU Regulation calls for fines up to 2% of w/w turnover Things to do: - check processing in light of data protection principles - make sure a comprehensive notice is available to users - be specific in indicating purposes of processing - if notice is OK, then consent can be obtained through a conduct (e.g. use of the device) HERE, THERE AND EVERYWHERE i.e. MOBILITY DATA UNDER EU LEGISLATION