05 Jun 2013 Ed Johnson-Williams Data Protection

What are Mobile Providers Doing with Customer Data? – The results so far

Since we set up the tool, hundreds of you have used it to contact your mobile provider. Many of you have forwarded us the responses you’ve had from your mobile provider – thank you!

What, then, are mobile companies telling customers who contacted them? And what do their Privacy Policies say?

O2, Vodafone and EE have all replied to their customers to say that they provide analytics on aggregated and anonymised data sets of their customers to third party companies. Their privacy policies have sections to this effect.

Virgin Media say that they don’t sell their customers’ data and their privacy policy says they may pass on aggregate information about their customers’ mobile use to third parties.

EE have told us that all customers have agreed to their Privacy Policy and implied that this counts as customers giving consent. O2 and EE argue in their responses to customer emails that because they are aggregating and anonymising data, the law does not require them to ask customers to opt-in or opt-out.

The vast majority of people want a mobile phone connection to help them manage their lives. In effect, mobile providers are presenting their customers with the choice of whether to have a mobile phone or to have their data included in mobile analytics datasets.

Come to a discussion panel in Parliament today at 2PM to hear more about mobile analytics and privacy. Representatives from EE, the ICO and Ipos MORI as well as Julian Huppert MP and Joss Wright from the Oxford Internet Institute will be discussing how mobile providers are handling data, what consent customers should expect to have and how data is being anonymised and aggregated.

Have a look to see what your mobile provider is doing with customer data and what their privacy policy says. For more information about what they said in their responses and the relevant contents of their privacy policies, see the ORG wiki page.

	What they’re telling their customers	What their Privacy Policy says
EE	We are able to provide historical reports from our database about mobile network usage of large groups of customers. These reports analyse how, when and where our network is being used by these large groups and what it is being collectively used for. EE does not sell any individual customer’s personal data. All data shared is anonymised and aggregated so that it is not possible to identify an individual. EE anonymises data in accordance with industry standard and the ICO Anonymisation Code of Practice as appropriate to the data in question. As market research that is shared with third parties is anonymised and aggregated, and it is not possible to identify an individual, we currently don’t offer an opt-out for – network level data.	We use your personal information for the following purposes: to provide aggregated statistics about our sales, customers, traffic patterns to third parties, but these statistics will not include any information that is likely to identify you to carry out research and analysis and monitor customer use of our network and products and services on an anonymous or personalised basis to identify general consumer trends and to understand better our customers’ behaviours and partner with other businesses to create new services and to develop interesting and relevant products and services for our customers, as well as personalise the products and services we offer you.
Vodafone	Vodafone is evaluating analytics projects, and we’re aware that these types of activities can only succeed if customers have control over how their data is used and feel that they receive some value in return. While we believe that anonymisation and aggregation are important steps in protecting data, we are also in the process of developing better tools to enable customers to make informed choices about their participation in these types of projects. We participate in an industry-wide initiative started in the UK in 2008 to provide mobile audience web and app measurement for publishers and advertisers. There was no mention of how to opt-in or opt-out of such analytics.	We may use and analyse your information to: Carry out research and statistical analysis to monitor how customers use our network, products and services on an anonymous or personal basis The information we use will be your approximate location, based on the nearest mobile cell site. As a result, this will change as you move around with your mobile phone. Vodafone appear to do their mobile analytics in house with Vodafone Global Enterprise. We track communications records, data usage and location-based information to the nearest town. The data is aggregated and analysed at a numerical level and participants can choose to remain anonymous when they sign up, so they aren’t personally identifiable from their data.
O2	In 2012 we announced a data analytics business which included a product called Smart Steps. Smart Steps is about measuring the size of anonymous crowds of people – this does not include the selling of any individual customer’s data and it will never be possible to identify an individual customer. Smart Steps extrapolates trends from anonymised and aggregated data. Customers’ personal information is never sold or disclosed. With Smart Steps, there is no disclosure of a customers’ personal identity to “opt out” from.	We may use and analyse information about you in order to: aggregate information about you, your spending and your use of the Services with information about other users of the Services in order to identify trends. We may pass Aggregated Data to third parties, such as advertisers, content providers and business partners or prospective business partners, to give them a better understanding of our business and to bring you a better service. Aggregated Data will not contain information from which you may be personally identified. analyse information about you including your calling, searching, browsing and location data on a personalised or aggregated basis. We may pass this data to the third parties mentioned above and we may use this information to provide you with targeted O2 or third party offers, promotions, adverts or commercial communications.
Virgin Mobile	Thanks for getting in touch. I can confirm that Virgin Media does not sell customer data. As such, we do not have an opt-in/opt-out policy. I hope this answers your question.	We may use aggregate information and statistics for the purposes of monitoring usage of our services in order to help us develop our services, and may provide such aggregate information to third parties, for example, content partners and advertisers. These statistics do not include information that can be used to identify any individual.
Tesco Mobile	Tesco Mobile does not sell or pass on any customer data or anonymised data externally. We do at times use our customer information internally to understand shopping behaviours and to develop and improve our products and services.	We would like to reassure you that your details are safe and will never be released to companies outside the Tesco Group for their marketing purposes. We will share your details among Tesco companies at home and abroad (e.g. Tesco Personal Finance) and businesses that process this information on our behalf (e.g. printers who need certain details to print mailings.
Three	We have received a number of similar enquiries from consumers who have been prompted to contact us following press reports or by the Open Rights Group campaign. We know that data privacy is of utmost concern to our customers and we can confirm that Three does not sell customer data. There may be circumstances where information is shared with third parties, such as service providers who help us deliver services to customers, or deliver services that the customer has subscribed to directly, but there are always be carried out in full compliance with privacy laws.	We may process “Your Information” for a number of purposes including: to carry out market research
giffgaff	No reply yet – Please let us know if you’ve had a reply from giffgaff.	We may use and analyse information about you in order to: Aggregate information about you, your spending and your use of the Services with information about other users of the Services in order to identify trends. We may pass Aggregated Data to third parties, such as advertisers, content providers and business partners or prospective business partners, to give them a better understanding of our business and to bring you a better service. Aggregated Data will not contain information from which you may be personally identified.
TalkTalk	No reply yet – Please let us know if you’ve had a reply from TalkTalk.	We may also use your information for research and statistical analysis with the aim of improving our services. We may use the personal information we collect from you to build up a profile of your interests and preferences. This information may be disclosed to other companies in the TalkTalk Group Limited group of companies and carefully selected third parties and/or used to make you aware of products or services that you may find of interest.

Some of the companies’ replies and all of their privacy policies are long so are heavily abridged here.