Dutch Court Overturns €600K GDPR Fine Over Inadequate Personal Data Proof
Written by AI from the linked story. Not reviewed by an editor. How this works
The Dutch Data Protection Authority (DPA) failed to sufficiently demonstrate that pseudonymized MAC addresses and location data collected for pedestrian counting constituted 'personal data' under GDPR, specifically regarding the realistic feasibility of re-identification. This case highlights that regulators bear the burden of proving re-identification is reasonably possible, not merely theoretical. It also underscores that pseudonymization, when implemented effectively, can serve as a meaningful legal and technical defense. Organizations must nonetheless carefully assess their data classification processes and legal bases before processing any potentially identifiable data, as outcomes can vary significantly based on context and jurisdiction.
Tactical Insight
Immediate Actions
- Conduct a Data Protection Impact Assessment (DPIA) before deploying any data collection systems that capture network identifiers or location data.
- Establish and document a clear legal basis (e.g., legitimate interest, consent) for each category of personal or potentially personal data processed.
Data Classification & Pseudonymization
- Implement a formal data classification policy that evaluates re-identification risk using concrete criteria such as available auxiliary data, technical feasibility, and cost.
- Ensure pseudonymization techniques (e.g., hashing or truncating MAC addresses) are documented with evidence demonstrating that re-identification is not reasonably achievable.
- Engage legal counsel to validate whether collected data qualifies as personal data under applicable regulations before processing begins.
Long-term Governance Improvements
- Build an internal regulatory compliance review process that stress-tests legal bases and data minimization claims against current DPA and court interpretations.
- Train data engineers and project managers on GDPR definitions of personal data, including edge cases involving pseudonymized identifiers and indirect identification.
- Establish a periodic review cycle to reassess data collection practices as legal interpretations and re-identification technologies evolve.