Processing of traffic data in mobile content services - PTS-ER-2010:1
29/01/2010
PTS and the Swedish Data Inspection Board have jointly investigated the processing of traffic data in mobile content services as a step in these authorities' ambition to achieve a greater level of clarity through collaboration. This area is complicated: first because it is technically complex, and second because there are two competing statutes in this field, namely the Electronic Communications Act (2003:389 – LEK) and the Personal Data Act (1998:204 – PuL), in which connection different authorities are responsible for supervision and compliance.
This report was preceded by a general study, where a number of operators, aggregators and content suppliers responded to written questions about how they use traffic data when providing mobile content services. This study forms the basis of the survey of how the market functions from a technical perspective as well as the conclusions and recommendations made. When applicable, reflections are also presented concerning how the stakeholders have responded as a group. However, the study conducted was not primarily intended to provide a basis for assessing individual cases; rather, the aim was to compile facts on which the authorities could base their reasoning about the need for legislation and security measures.
It should also be mentioned in this context that the market as such is rather immature. It should consequently be dealt with in such a way and using means that enable growth while also observing the rules and recommendations aimed at protecting the privacy of users and thus also confidence in these services in the long run.
The authorities found that, on the whole, the stakeholders manage traffic data processing in a satisfactory manner. However, stakeholders had differing perceptions of which systems of rules covered their operation, which is unfortunate as this also means that there may be some uncertainty about where the responsibility for processing lies. The study of content suppliers showed that the information provided by them to data subjects can be improved in several respects; for example, regarding the right to receive extracts from records and the possibility of requesting rectification, and similarly having the purpose of the processing explained.
The authorities have therefore identified a need to clearly explain the applicable regulatory provisions and also how such regulation should be applied in terms of the processing of data that takes place in practice.
This report includes recommendations concerning the appropriateness of using telephone numbers as identification, information in conjunction with consent and recommendations for enhanced security when transferring data. The aim of these recommendations is to achieve the following objective: that the growing market for mobile content services fulfils both the users' need for advanced content and their need to protect their privacy and security. The authorities hope that this report represents a step towards achieving this objective and will continue to observe how the market develops.