Cybersecurity Policy Report, Spanish DPA Issues Guidance on Wi-Fi Tracking, (May 9, 2024)

By Tony Foley

The Spanish data protection authority, Agencia Española de Protección de Datos (AEPD), has released guidance, in collaboration with several regional DPAs, on personal data processing incorporating Wi-Fi tracking technologies.

In a Tuesday news release, AEPD explained that Wi-Fi technologies allowed mobile devices to be identified and tracked through their Wi-Fi signals, detecting the presence of a device in a particular area and identifying movement patterns. The agency maintained that these technologies posed serious privacy risks by allowing people’s movements to be tracked without their knowledge and without an appropriate legal basis. The guidance analyzes the impact of Wi-Fi technologies, identifies the main risks associated with them, and offers recommendations for their safe use.

The guidance, which may be downloaded from the press release but is available only in Spanish, was developed along with the Catalan, Basque and Andalusian DPAs. It specifies that the use of Wi-Fi technologies for tracking purposes involves the processing of personal data and therefore must be compliant with the principles, rights, and obligations imposed by the European Union’s General Data Protection Regulation (GDPR).

The guidance provides that, in general, controllers must conduct a data protection impact assessment, even in cases where the person responsible for the processing may not be clear about its obligations. It is also necessary to comply with the GDPR’s transparency principles through clear and accessible information like visible panels with information, public signage, voice alerts, or information campaigns.

The guidance further provides a list of measures that should be implemented if all the requirements for compliance with the GDPR are exceeded, including anonymizing and aggregating data, limiting the scope in which tracking is carried out using Wi-Fi, not assigning the same identifier to a mobile device on a different visit to the same place, implementing security measures equivalent to the level of risk, and conducting continuous reviews or independent audits.

News: InternationalLegislation DataPrivacy GDPR