RVS - 202401622/1/A3
Dutch court overturns €600K GDPR fine over pseudonymized MAC addresses and location data.
The Council of State in the Netherlands has overturned a €600,000 fine imposed by the Dutch DPA. The fine was issued for processing personal data without a legal basis, specifically pseudonymized MAC addresses and location data collected for pedestrian counting. The court found that the DPA failed to adequately prove that this data constituted personal data under GDPR, particularly regarding the feasibility of re-identification.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Autoriteit Persoonsgegevens?
Get an email when a new story names Autoriteit Persoonsgegevens, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Dutch Data Protection Authority (DPA) failed to sufficiently demonstrate that pseudonymized MAC addresses and location data collected for pedestrian counting constituted 'personal data' under GDPR, specifically regarding the realistic feasibility of re-identification. This case highlights that regulators bear the burden of proving re-identification is reasonably possible, not merely theoretical. It also underscores that pseudonymization, when implemented effectively, can serve as a meaningful legal and technical defense. Organizations must nonetheless carefully assess their data classification processes and legal bases before processing any potentially identifiable data, as outcomes can vary significantly based on context and jurisdiction.