An investigation by the Rijksinspectie Digitale Infrastructuur (RDI) reveals that Odido processed traffic data internally for the purpose of a collaborative project with the Central Bureau of Statistics (CBS). The aim was to develop an algorithm that could provide information about movements of large groups of people. Odido's internal processing of traffic data did not comply with the Telecommunications Act. The RDI therefore fined Odido 175,000 euros.
The traffic data was processed by Odido using the algorithm to create counts of large groups of people in an area. Traffic data contains privacy-sensitive data, such as about times of phone calls and locations of callers. Odido may use this data for legally permissible purposes, such as its own billing. But the operator should not have processed this (raw) traffic data for this cooperation project. Incidentally, the RDI did not find that this raw traffic data was provided to CBS.
The breach lasted from the beginning of 2018 to the end of 2019. During this period, traffic data from approximately 2.5 million to 4.5 million subscribers was used. The RDI considered several factors in determining the amount of the fine, including the duration of the violation and the amount of data used. In addition, the RDI considered as a penalty-reducing circumstance that the investigation did not show that the violation resulted in serious consequences or effected risks.
The collaborative project between Odido and CBS ended in early 2020. The RDI has not identified any violations since then.
Decision imposing administrative fine and decision on objection (1)
Telecom providers (2)
(1) https://www.rdi.nl/documenten/besluiten/2024/03/18/beschikking-tot-oplegging-bestuurlijke-boete
(2) https://www.rdi.nl/onderwerpen/telecomaanbieders
