This article is more than 1 year old
Belgian city slurps mobile data to track visitors
Local regulator says it hasn't approved scheme. Meanwhile, Spain up to similar tricks
Updated The Belgian city of Kortrijk in West Flanders is using data provided by a mobile phone company to count the number of people present in the town and where they come from.
Even more worryingly, local public-service broadcaster VRT has reported that city officials will try to cross-reference this data with credit and debit card databases.
Kortrijk is a popular tourist destination: between July and August, 799,336 people visited the town, almost 20,000 a day when students, employees and residents are excluded.
According to VRT, the city is paying telco Proximus €40,000 a year for data on how many phones are in each part of the city, presumably using cell location data. Proximus then apparently extrapolates data for the rest of the area while taking into account subscribers to other networks and those without mobile phones. We've asked both Proximus and local city officials for comment*.
But the Belgian data protection regulator has told The Register that, contrary to reports, it had not approved the scheme and was examining whether or not it breaks Belgian data protection law.
In an email, a spokesperson said:
We did not approve the tracking of mobile phones in Kortrijk. The Privacy Commission (the predecessor of the Belgian Data Protection Authority) had reacted positively to a similar project in 2016; that was three years ago and was not about this precise case. We have heard concerns from citizens about this project, therefore we will look into it. We cannot comment further at the time because we do not have all the details about the project and the processing.
The data will be collected once every three months and analysed to improve marketing campaigns for tourism and commerce.
Data provided to the city apparently includes the nationality of the subscriber or the province or even municipality within Belgium they come from.
The intention is that city hall will then cross-reference this with data from Visa and debit card companies to see how much people are spending. VRT said the first results show sales days bring in more visitors – 49,000 for Whit Sunday. Of these, 79 per cent of local visitors were from West Flanders, 4.82 per cent came from Hainault, and 1.53 per cent from Antwerp. Of foreign visitors, half were French and 14 per cent Dutch.
It also emerged yesterday that the statistics authority in Spain (Instituto Nacional de Estadística, INE) is planning to track every mobile handset in the country that uses the three largest network providers – Movistar, Vodafone and Orange – over a period four days in November.
Between 18 and 21 November, mobile subscribers will be counted and their location logged. A further four days of data slurping are already planned for Christmas and next summer.
Spanish citizens have been assured the data will be anonymous and aggregated.
To ensure anonymity, the INE has divided the country into cells with a minimum of 5,000 inhabitants. So Madrid is made up of 128 cells while in rural areas the individual cells will stretch for miles.
Location checks will be made between midnight and 6am to establish a place of residence, and again between 9am and 6pm when subscribers are assumed to be at work. To account for shift workers, locations will also be checked at six specific points during the day – 6am, 10am, 2pm, 6pm, 10pm and 2am.
The aim is to provide information on numbers of people commuting from dormitory towns into municipal centres and those staying near home for work.
Researchers also hope to gain a better understanding of so-called "empty Spain" – the swathes of rural countryside suffering severe depopulation. The institute will run similar checks for two days in the summer and on Christmas Day to check holiday movements.
The INE is confident that no data laws will be breached by the mass surveillance because the data is genuinely anonymised. It also notes that similar questions are asked in the Spanish census.
An INE mouthpiece told The Register (courtesy of Google Translate):
The INE is conducting a study based on data from mobile phones to incorporate them into the mobility information it offers traditionally in the Population and Housing Census.
The methodology of the study divides the national territory into about 3,200 cells, each of they with at least 5,000 residents. For each cell, the INE will receive information from all three Spain's main mobile phone operators on how many terminals are they find in that cell at various times of the day.
This information will be limited to a terminal count that will be provided to the INE [in the] form of aggregate tables of results. Operators will not provide individual data on telephone numbers, or on the holders of the lines, so that under no circumstances will the INE be able to track the position from any terminal.
The INE wants to emphasise that it is a submitted statistic, like all that it produces, to the Law on Public Statistical Function, which guarantees statistical secrecy and that complies with all the requirements of the Data Protection Law.
An El Pais report is here, in Spanish. ®
* Updated at 0900 on 1 November to add
City officials got in touch with The Reg to say (translated): "We do not collect the data itself but get reports from Proximus. These reports are completely anonymous and only show how many people have visited our town and from what country, or city.
We could never track anyone individually and would never want to.
Thus, only streams of visitors larger than 30 people are counted by Proximus.
So [for example] if there are 250 people from Antwerp who visit our city on a Monday, we'll know; if only 28 did, we will not."
Such reports "allow us to spend our marketing resources more efficiently and see whether certain campaigns work or not.
"How many people really go car-free on a Sunday? Is it worth publishing [a campaign article] in a Walloon magazine or is it a waste of money? Moreover, we also use this data to better solve complex mobility issues."
It did not respond to a question about payment data cross-referencing.
Biting the hand that feeds IT
