Bumbee Labs’ controversial tracking service now gets the thumbs up from the Swedish Data Protection Authority. It no longer breaches the Personal Data Act.
After a collaboration with the municipality of Västerås, many reported on Bumbee Labs’ potentially privacy-intrusive service. With the service, the municipality could see how the population moved around the city (though not at an individual level). In the summer, the Swedish Data Protection Authority ruled that the service, in its form at the time, breached the Personal Data Act (PUL).
“We have now made the changes the Data Protection Authority wanted us to make, and they have approved us. It is the first decision of its kind in Europe,” says the company’s founder and chair Staffan Liljestrand.
What was wrong with the old version is relatively complicated. At its core, it is about whether so-called MAC addresses should be regarded as personal data or not.
A MAC address is a unique ID for every computer, phone or other device that can connect to the network via Wi-Fi. However, it cannot be linked directly to an actual person. That, at least, is Bumbee Labs’ position. The Data Protection Authority, on the other hand, considers that a MAC address should count as personal data. The consequence is that they judged the previous version of Bumbee Labs’ service to breach the Personal Data Act.
Hold on, because now it gets complicated. The Data Protection Authority justifies its summer decision by saying that the MAC address can be indirectly linked to a person. That would be the case if it had been registered together with personal data in other contexts, for example by the mobile operator or when logging into a Wi-Fi network with the phone.
After the Data Protection Authority’s decision, Bumbee Labs changed its service and no longer stores any MAC addresses.
“Our service now works roughly like those cables you sometimes see on major roads that anonymously measure how many cars pass a certain point. Except digitally, and with mobile phones, across entire cities. The only information we store is the phones’ position. All personal data is irreversibly deleted within a couple of seconds. We simply give our customers the ability to see how a city’s visitors move as a group,” says Staffan Liljestrand.
The media focus on the fact that the service could be used to track individuals has been considerable. But Staffan Liljestrand says that both the company itself and its customers are completely uninterested in individuals. It has, however, been difficult for the company to turn that narrative around, which has made some customers take a wait-and-see attitude to the service.
“Some of our customers chose to wait for the decision from the Data Protection Authority before they started using the service. This decision means that more will feel confident using the service,” says Staffan Liljestrand.