EE selling your data to pollsters and police

The details that have emerged since imply that access to the data is partially controlled by use of “anonymisation” – a controversial practice which many people believe to be highly circumventable in practice.

According to the Sunday Times (Paywall), the data offers the following insights:

• Gender, age and postcode of users as well as friendship networks, plus calling circles, customer interests (eg sport, film, news) and activity at work or at home
• Calls data, including time of day call is made, number called, duration of call and customer location to a 100-metre radius
• Data on texts, including time of day it is sent and location of customer
• Mobile web and app usage, including domain name of sites visited, session length, duration on site, previous and next sites visited and amount of data uploaded and downloaded during session
• Customer location, which is determined by call records or mobile phone ID, to an approximate accuracy of 100 metres, and profiles of customers, potentially including spending patterns.

Access to such data normally requires personal consent in data protection law. This is why
Ipsos Mori have been quick to reject claims that the data would allow for any individual to be singled out (Press Release).

Ben Page, the CEO of Ipsos Mori, has taken to Twitter to assure critics that their data only provides aggregates of 50 people within a 700 sqm area, or “across a time period”, showing “mas[s] movements of people – but not individuals”. The data is “anonymised” by EE and according to Page it would allow the Met to know “what travel, crime, info sites people look at when in West End for example, but anonymously”.

However, the Sunday Times article contains details of conversations between Ipsos Mori and the Met about the ability to track individual protesters after a demonstration. This would be surveillance on a par with the Snoopers’ Charter and it is perhaps unlikely that a major company would commit such major privacy blunder. However, what employees are doing or saying is another thing.

The Sunday Times’ evidence is that employees are making such claims: this must be investigated by the ICO, or a police force other than the Met. After all, T-Mobile’s employees (now part of the EE group) got into trouble in 2009 by selling customer data – thus we do not have confidence that official positions are without doubt representative of practice on the ground.

However, even if the most serious claims turn out not to be true, the incident reveals a massive loophole in UK data protection law, parallel to practices in the USA that are seeing anonymised or pseudonymised data being sold and reused on a massive scale and in the developing world: for instance Jana obtains data from millions of developing world mobile phone customers.

The deal is part of growing trend by companies to make money out of data they collect in the course of carrying their businesses. Credit card companies, car manufacturers, and of course, mobile phone operators are creating secondary revenue streams.

Ipsos Mori argue that their system is compatible with EU data protection, but this may not be the case. Telefonica launched a similar service, but withdrew it from Germany. In Germany customers would have to give their consent for this kind of data use, but not in the UK. This is a good example for why we need the new European Data Protection Regulation. 

The attempt by big business to remove anonymised personal data from your control is one of the central battlegrounds in the new Data Protection Regulation, being debated in Europe right now.

Companies including EE and other telcos are arguing that consent should not be necessary to resell data or access to third parties. While that may be a business opportunity, it is also one that is already undermining trust between consumers and business in the USA and the UK.

The EE deal with IPSOS MORI and subsequently the police is as good example as any why we should be supporting the new Data Protection Regulation and resisting attempts by big business to remove the need for consent to anonymise your data. 

Today what was previously thought of as a technical question showed itself to have very clear and disturbing consequences. Let your MEPs know that you need them to protect your data rights, by sending a postcard through the Naked Citizens campaign site.

Update: EE called us this afternoon to talk about what happened. We promised we would write back with the policy asks we have for anonmymisation techniques.