No right to access your own location data? noyb files appeal against Spanish DPA

Today, noyb filed an appeal against a decision of the Spanish DPA (AEPD) regarding the phone provider Virgin Telco. A customer made an access request to receive his location data which was refused by Virgin Telco. The AEPD sided with the company and restricted the user’s access right under the GDPR, based on a surprising interpretation of the law.

Your location data only for law enforcement? Despite multiple Court of Justice (CJEU) decisions prohibiting data retention, some EU Member States, like Spain, still require mobile network operators to record the meta data of all phone calls, short messages and cell tower logins. The European Charter of Fundamental Rights and the GDPR grants a right of everyone to access his or her personal data. A Spanish customer exercised his right to access under the GDPR and requested his location data from the mobile phone provider Virgin Telco. The company refused to disclose the data, arguing that only authorities during criminal investigations may have access. Virgin Telco did not explain why the fundamental right to access would not apply in this case. There is also no relevant limitation under the law.

“The fundamental right to access is comprehensive and clear: users are entitled to know what data a company collects and processes about them - including location data. This is independent from the right of authorities to access such data. In this case, there is no relevant exception from the right to access.”   - Felix Mikolasch, Data Protection Lawyer at noyb

Leave a Comment