Dutch DPA Fine Overturned Due to Insufficient Proof That MAC Addresses Constitute Personal Data
Written by AI from the linked story. Not reviewed by an editor. How this works
The Council of State overturned a €600,000 GDPR fine against the Municipality of Enschede because the Dutch DPA could not sufficiently prove that pseudonymised MAC addresses and location data qualified as personal data under GDPR. This case highlights a critical gap in regulatory enforcement: the legal definition of 'personal data' is context-dependent, and pseudonymisation can shift the burden of proof significantly. Organisations and regulators alike must rigorously assess whether data elements can reasonably identify individuals before classifying and enforcing them as personal data. This ruling matters because it sets a precedent that challenges assumptions about pseudonymised data, potentially affecting how organisations design privacy programmes and how DPAs build their enforcement cases.
Tactical Insight
Immediate actions
- Conduct a formal data classification review to determine whether pseudonymised identifiers (e.g., MAC addresses, hashed IDs) meet the GDPR threshold for personal data in your specific context.
- Document the legal basis for every data processing activity and ensure evidence is robust enough to withstand regulatory or judicial scrutiny.
Long-term improvements
- Establish a Data Protection Impact Assessment (DPIA) process that explicitly evaluates re-identification risk for all pseudonymised datasets before processing begins.
- Engage qualified legal counsel and a Data Protection Officer (DPO) to maintain ongoing interpretive guidance on evolving personal data definitions.
- Embed GDPR compliance reviews into the full data lifecycle, from collection through deletion, ensuring lawful basis is documented and defensible at each stage.
Detection & Governance measures
- Implement a data inventory and mapping tool to track what data is processed, its classification status, and its legal justification at all times.
- Establish periodic internal audits to re-evaluate whether pseudonymised data processing still falls within the intended legal basis as regulatory interpretations evolve.