A municipality that counts passers-by to make its shopping streets more attractive is fined €600,000 by the Dutch Data Protection Authority (AP), and subsequently wins in court. It sounds like good news for municipalities and retailers that use Wi-Fi tracking to map visitor flows. But a careful reading of the judgment by the Overijssel District Court shows above all that the case turned on a problem with the AP’s evidence, not on a licence to handle location data carelessly.

In this blog, we explain the case, set out exactly what happened from a legal perspective, and show what proper pseudonymisation of MAC addresses could have meant in practice. For Enschede, and for every organisation that collects similar data.

The case: Wi-Fi tracking in Enschede city centre

Between 2018 and 2020, the municipality of Enschede had ten sensors installed in the city centre to measure the number of passers-by 24 hours a day. The aim was to gain better insight into visitor numbers so that shopping streets and events could be optimised. The sensors recorded the MAC address of every mobile device with Wi-Fi enabled and thus tracked which device passed which sensor.

Following reports from concerned citizens, the AP launched an investigation. It concluded that the municipality had allegedly processed personal data without a valid legal basis, in breach of Article 5(1)(a) and Article 6(1) of the GDPR. The AP imposed an administrative fine of €600,000. Enschede lodged an objection and subsequently appealed to the Overijssel District Court.

Read more