Google Penalty Order

The DPA imposed a penalty order on Google on March 23, 2011, after an investigation indicated that the company had used its Street View vehicles to collect data on more than 3.6 million Wi-Fi routers in the Netherlands, both secured and unsecured, during the period March 4, 2008, to May 6, 2010, and had also calculated a geolocation for each router.  Such  acts constituted a violation of the PDPA. According to a DPA press release, “MAC [media access control] addresses combined with a calculated geolocation constitute personal data in this context, because the data can provide information about the owner of the WiFi router in question.”[129]

Subsequently, the DPA verified Google’s compliance with all the requirements of the order, one of which was to offer an opt-out option enabling people to object to the processing of data on their WiFi routers. Beginning in mid-November 2011, “Google has offered users the option to add ‘_nomap’ to the network name of their WiFi router to stipulate their refusal to let Google process their information”; in the DPA’s view, “Google now provides those involved with a free and effective opt-out possibility.”[130] Google also indicated that it was destroying all data collected in the Netherlands by means of the Street View vehicles and would be implementing that step globally.[131] The DPA further determined that Google had complied with the requirements to irreversibly delete network names (SSIDs) and to report its data processing to the DPA.[132]

User Anonymity

Under the Telecommunications Act, network and service providers are to delete or anonymize traffic data processed and stored by them relating to subscribers or users once this traffic data is no longer needed for the purpose of the transmission of communications, without prejudice to certain other provisions of the Act.[66] For example, a service provider may process traffic data to the extent and duration necessary for: (a) market research or sales activity relating to electronic communications services, or (b) the supply of value-added services, provided that the subscriber or user to whom the traffic data relates has given his consent, and the subscriber or the user may at any time revoke the consent given for such processing

Source: Privacy Online