Bumbee Labs’ controversial tracking service now gets the thumbs up from the Swedish Data Protection Authority. It no longer breaches the Personal Data Act.
After a collaboration with the municipality of Västerås, Bumbee Labs’ potentially privacy-intrusive service was widely reported on. With the service, the municipality could see how the population moved around the city (though not at an individual level). In the summer, the Swedish Data Protection Authority ruled that the service, in its form at the time, breached the Personal Data Act (PUL).
“We have now made the changes the Data Protection Authority wanted us to make, and they have approved us. It is the first decision of its kind in Europe,” says the company’s founder and chair Staffan Liljestrand.
The problem with the old version is relatively complicated. It comes down to whether so-called MAC addresses should be regarded as personal data.
A MAC address is a unique ID for every computer, phone or other device that can connect to the network via Wi-Fi. It cannot, however, be linked directly to an actual person, or at least that is Bumbee Labs’ position. The Data Protection Authority, on the other hand, considers that a MAC address should count as personal data, which is why it judged the previous version of Bumbee Labs’ service to breach the Personal Data Act.
Hold on to your hat, because this is where it gets complicated. The Data Protection Authority based its summer decision on the MAC address being indirectly linkable to a person. That would be the case if it had been registered together with personal data elsewhere, for example by the mobile operator or when the phone was used to log in to a Wi-Fi network.
After the Data Protection Authority’s decision, Bumbee Labs changed its service and no longer stores any MAC addresses.
“Our service now works roughly like those cables you sometimes see on major roads that anonymously measure how many cars pass a certain point. Except digitally, and with mobile phones, across entire cities. The only information we store is the phones’ position. All personal data is irreversibly deleted within a couple of seconds. We simply give our customers the ability to see how a city’s visitors move as a group,” says Staffan Liljestrand.
Media coverage has focused heavily on the fact that the service could be used to track individuals. Staffan Liljestrand says that both the company and its customers are completely uninterested in individuals. Even so, the company has found it hard to turn that narrative around, and some customers have taken a wait-and-see attitude to the service as a result.
“Some of our customers chose to wait for the decision from the Data Protection Authority before they started using the service. This decision means that more will feel confident using the service,” says Staffan Liljestrand.