The National Statistics Institute , as part of an unprecedented initiative on the European scene, has reached an agreement with the three main mobile operators in the country to carry out a study of citizen mobility based on the monitoring of mobile terminals . The tracking will be carried out anonymously and providing the data in an aggregate way, without providing any type of information about the holders of the lines except their movements in certain time slots.
The follow-up will take place during four business days in November, one Sunday and three days of holidays . According to information published by the newspaper El País, the monitoring will take place between November 18 and 21, Sunday November 24, two days of summer (July 20 and August 15) and December 25. The main objective of the study is to know the habitual movements of the population and seasonal movements (in the summer and Christmas holidays) both in terms of time and destinations. This is intended to expand knowledge about the areas in which public services and infrastructures could be improved, but it also provides very valuable information on the movements of the population for work reasons, for example, from dormitory cities or small towns to large cities. .
According to the information provided by El País, the INE has divided the national territory into 3,500 cells with a minimum of 5,000 people in each one , causing the size of the cell to vary according to the population density of each area. The monitoring will take place at six specific times throughout the day: at 6:00 a.m., 10:00 a.m., 2:00 p.m., 6:00 p.m., 10:00 p.m. and 2:00 a.m. For its part, the INE has confirmed to statements to the newspaper El Confidencial that the operators that will transfer their data are Movistar, Orange and Vodafone and that they will receive, between the three, about half a million euros .
Technical and legal difficulties?
But, what problems can the INE project bring or generate? VERY INTERESTING has contacted Sergio de Juan-Creix, professor of Law and Political Science Studies and expert in digital law, and José Antonio Morán, Professor of Computer Science, Multimedia and Telecommunications Studies at the UOC, to clear up any doubts .
From a technical point of view, there is not the slightest problem . According to José Antonio Morán, the communication network of the operators knows at all times where each of the terminals it has connected is is, it verifies it every certain period of time and makes a record of its movements. This information is collected by companies that, to ensure anonymity before sending it to the INE, must carry out a process that ensures the elimination of any identifier (such as the phone number or IMEI, International Mobile Equipment Identity ) through a database. of parallel data and the emission of these as aggregated data, preventing them from being analyzed individually. Thus, it is achieved that there is no clear way of “identifying one by one the terminals or the precise information of the position”.
The anonymity of the data is a key piece in the INE project since one of its main arguments when defending the legality of the action is the fact that if the data is completely anonymous, the General Protection Regulation does not apply to it. Data . Therefore, and according to Sergio de Juan-Creix, “the main issue is to see if this data is really anonymous and that it can never be associated with a person, not even with reverse engineering.” If this process is carried out correctly, the INE and the companies can rely on a legal basis to carry out the statistical use of data; This basis may be the consent of the users (it may be requested in the general conditions of the companies) or the legitimate interest of a study like this for statistical purposes. For the Law professor, precisely, the entire project is based on anonymity and purpose .
Both experts agree that, despite the existing precedents in the misuse of data for commercial purposes, Big Data can be very beneficial for the population if it is used correctly and that social alarms and fear of application of technology. The problem, therefore, comes from ignorance. Many Spaniards, upon hearing the news, will have tried to remember when they agreed to give up their data for these purposes and José Antonio Morán believes that “what has most shocked people has been not finding an explanation for all this.” “Starting with the feeling that they spy on us is not good,” says Morán, and therefore a process of pedagogy and rapprochement is necessary, as well as a greater presence in making decisions about the use of their own data, so that the the population better understand the situation and know when their data is being used well and when they should defend their rights. “The risk that exists is that, with the emergence of the Internet of things and smart cities, the data we generate is increasingly being captured. You have to explain things very well in order to build trust ”, Morán concludes.
For his part, for the lawyer specialized in Law and technology David Maetzu, points out in a thread on his Twitter account the illegality of this transfer on the basis that the traffic and position data are not only regulated by the Data Protection Law but also by Law 25/2007 . This law establishes the assumptions in which the transfer of traffic or position data is justified and statistical use is not one of them, so that the companies could not deliver the information to the INE. Maetzu also points out that the law “does not provide penalties for those who transfer data by skipping it.”
Can someone sneak away?
Before this question, Sergio de Juan-Creix answers yes, although it is not easy . The first thing to understand is that, without having to scare us, in the current scenario “data has a lot of value” and therefore it is important that users know their rights and know how to enforce them .
Even in the cases in which the telemarketers base their transfer of data on an explicit consent or a legitimate interest, any user can exercise their right to object to the operators and refuse to allow their data to be used for these purposes . A complaint procedure could also be filed with the Data Protection Agency. There are previous cases in which operators or other types of companies pay a small penalty, taking into account the benefits they obtain. To avoid these cases and that the user is not harmed, it is important to exercise the rights that the user has and become a participant since the current data protection rule is based on proactive responsibility and it must be the user who claims the fulfillment of their rights and the correct use of your data, whether it is a company or the National Institute of Statistics itself.
