No right to access your own location data? noyb files appeal against Spanish DPA
Today, noyb filed an appeal against a decision of the Spanish DPA (AEPD) regarding the phone provider Virgin Telco. A customer made an access request to receive his location data which was refused by Virgin Telco. The AEPD sided with the company and restricted the user’s access right under the GDPR, based on a surprising interpretation of the law.
Your location data only for law enforcement? Despite multiple Court of Justice (CJEU) decisions prohibiting data retention, some EU Member States, like Spain, still require mobile network operators to record the meta data of all phone calls, short messages and cell tower logins. The European Charter of Fundamental Rights and the GDPR grants a right of everyone to access his or her personal data. A Spanish customer exercised his right to access under the GDPR and requested his location data from the mobile phone provider Virgin Telco. The company refused to disclose the data, arguing that only authorities during criminal investigations may have access. Virgin Telco did not explain why the fundamental right to access would not apply in this case. There is also no relevant limitation under the law.
“The fundamental right to access is comprehensive and clear: users are entitled to know what data a company collects and processes about them - including location data. This is independent from the right of authorities to access such data. In this case, there is no relevant exception from the right to access.” - Felix Mikolasch, Data Protection Lawyer at noyb
AEPD rejects complaint, without reasons given. The Spanish authority sided with Virgin Telco after the customer filed a complaint in December 2021, without giving any additional reasons. It simply said that it follows the (non-existent) reasoning of the company.
“It’s very problematic if a DPA decides without further explanation and without any legal reasoning supporting this conclusion.” - Felix Mikolasch, Data Protection Lawyer at noyb
Appeal filed. noyb supports the Spanish customer and field an appeal against the AEPD’s decision before the Audiencia Nacional, to ensure that users have a clear understanding about all data that is generated and kept about them.
Similar case in Austria. noyb already filed an appeal in a similar case in Austria in November 2021 where the Austrian data protection authority confirmed the refusal of the mobile operator to give its client access to their data, based on a highly questionable interpretation of national law. With the appeal filed today before the Audiencia Nacional, noyb wants to avoid that other data protection authorities adopt similar decisions which clearly violate a basic fundamental right.
