Pseudonymisation of location data: what the Enschede ruling teaches us

Pseudonymisation of location data and personal data by Viacryp

A municipality that counts passers-by to make its shopping streets more attractive is fined €600,000 by the Dutch Data Protection Authority (AP), and subsequently wins in court. It sounds like good news for municipalities and retailers that use Wi-Fi tracking to map visitor flows. But a careful reading of the judgment by the Overijssel District Court shows above all that the case turned on a problem with the AP’s evidence, not on a licence to handle location data carelessly.

In this blog, we explain the case, set out exactly what happened from a legal perspective, and show what proper pseudonymisation of MAC addresses could have meant in practice. For Enschede, and for every organisation that collects similar data.

The case: Wi-Fi tracking in Enschede city centre

Between 2018 and 2020, the municipality of Enschede had ten sensors installed in the city centre to measure the number of passers-by 24 hours a day. The aim was to gain better insight into visitor numbers so that shopping streets and events could be optimised. The sensors recorded the MAC address of every mobile device with Wi-Fi enabled and thus tracked which device passed which sensor.

Following reports from concerned citizens, the AP launched an investigation. It concluded that the municipality had allegedly processed personal data without a valid legal basis, in breach of Article 5(1)(a) and Article 6(1) of the GDPR. The AP imposed an administrative fine of €600,000. Enschede lodged an objection and subsequently appealed to the Overijssel District Court.

The ruling: the AP provided insufficient evidence

On 2 February 2024, the court delivered its judgment (ECLI:NL:RBOVE:2024:594) and upheld Enschede’s appeal.

The court began by noting that, when imposing a fine, the administrative authority must meet a high evidentiary threshold. The AP therefore had to demonstrate convincingly that personal data had in fact been processed; it was not enough merely to make it plausible that this might have been the case.

The AP argued that passers-by could be identified without disproportionate effort on the basis of the hashed MAC addresses and the known locations of the sensors. The court did not accept this argument. Merely showing that identification is technically conceivable is not enough. In light of Recital 26 of the GDPR, the supervisory authority should have investigated whether it was reasonably likely that someone would make the effort to carry out that identification in practice, taking into account the time, cost and technology required. Because the AP had not conducted that investigation, it had not been proven that the collected data constituted personal data. The basis for the fine therefore fell away.

It is important to emphasise that this judgment says nothing about the desirability of tracking citizens over Wi-Fi 24/7, nor about whether Enschede acted with due care. It concerns only whether the AP had produced sufficient evidence in this specific case. The AP subsequently appealed to the Administrative Jurisdiction Division of the Council of State. On 29 July 2026, the Council of State dismissed the AP’s appeal, making the outcome final. Importantly, this does not amount to a general finding that Wi-Fi tracking data cannot constitute personal data. In this administrative fine case, the AP had to provide sufficient evidence for the alleged infringement during the administrative decision-making process and could not remedy deficiencies in that substantiation later in the court proceedings.

What are MAC addresses, and why are they sensitive?

A MAC address is a unique identification number embedded in the hardware of every network device—from a smartphone or laptop to a smart thermostat. Because this address generally does not change, it can in principle be traced to one specific device and, therefore, often indirectly to the person carrying that device.

This makes MAC addresses privacy-sensitive: if the same MAC address is recorded at multiple locations and times, movement patterns can be reconstructed even without knowing the owner’s name.

There is an important distinction between a raw MAC address and a pseudonymised MAC address. With a raw address, the original hardware code is directly visible. With pseudonymisation, the address is replaced so that the original value can no longer be read directly. Nevertheless, depending on how the pseudonymisation is designed, the underlying device may still remain recognisable across time and locations.

The difference pseudonymisation makes

This is where technology and the legal assessment intersect—and where the greatest gains can be made.

Without pseudonymisation, the MAC address is directly traceable. Combined with sensor locations and timestamps, anyone with access to the data can reconstruct individuals’ movement patterns. These are unmistakably personal data within the meaning of the GDPR, and processing them requires a solid legal basis.

With superficial pseudonymisation—as in Enschede, where the MAC address was hashed but the hash itself remained stable and unique—a movement profile can still be built. In effect, the hash then functions as a new, permanent identifier. Whether it legally qualifies as personal data depends on the context and on how realistic identification is, as the court also found in this case.

Proper, purpose-driven pseudonymisation creates a materially different situation. Consider techniques such as:

  • One-way hashing with a salt, so that the original MAC address cannot be reconstructed;
  • Time-limited pseudonyms, where the pseudonym expires after, for example, one hour, so that linking across sessions is no longer possible;
  • Separation of the pseudonymisation key and the data, with key management taking place outside the processing system;
  • Minimal data retention, so that data are not kept longer than necessary for the purpose.

By combining these measures, linking the data to a natural person becomes virtually impossible, both technically and organisationally. This significantly reduces the likelihood that a supervisory authority will nevertheless classify the resulting data as personal data. More importantly, sound pseudonymisation is not merely a way to reduce legal risk; it is also simply a careful way of handling the data of people who were never asked whether they wanted to be tracked. Responsible data use and legal defensibility go hand in hand here.

How Viacryp helps: pseudonymisation of movement profiles

Viacryp has developed a proven approach for precisely this type of application: the secure pseudonymisation of personal data and movement profiles based on Wi-Fi and Bluetooth tracking. As a Trusted Third Party (TTP), Viacryp uses Privacy Enhancing Technologies (PETs) to enable organisations to analyse location data while protecting individual privacy and supporting compliance with the General Data Protection Regulation (GDPR). Shopping centres, municipalities and managers of public buildings can use these pseudonymised data to understand how visitors move through a space—for example, which walking routes are popular, how long people remain in a particular area and where bottlenecks arise—without unnecessarily identifying individual visitors.

The Viacryp approach is based on a few clear principles: pseudonymisation takes place before the data leave the system. Raw MAC addresses are never provided to Viacryp and therefore cannot be stored. There is a demonstrable and technically safeguarded separation between the pseudonym and the user’s identity. The entire process is also fully documented, so that privacy by design and privacy by default are not merely professed principles but can be demonstrated in practice.

Applied to the Enschede case: if the municipality had used an approach such as Viacryp’s, it could probably have demonstrated that identifying individual passers-by was reasonably impossible, supported by documented technical evidence rather than a retrospective debate about what is theoretically conceivable. That could have fundamentally changed the legal debate—and perhaps the entire proceedings.

Conclusion

Above all, the Enschede ruling illustrates one thing: the boundary between personal data and truly anonymous data is not fixed, but is determined by a system’s technical design. An organisation that can demonstrate that identifying individuals has been made reasonably impossible is in a stronger position, both legally and ethically. Proper pseudonymisation is therefore not a side issue or a nice-to-have, but a prerequisite for the responsible use of location data.

Would you like to know how Viacryp can help your organisation process visitor data responsibly and in compliance with privacy requirements? View our use case on the pseudonymisation of movement profiles.

Sources: Overijssel District Court, 2 February 2024, ECLI:NL:RBOVE:2024:594; Administrative Jurisdiction Division of the Council of State, 29 July 2026, ECLI:NL:RVS:2026:4403; Pellicaan Advocaten, ‘AP’s €600,000 fine imposed on the Municipality of Enschede overturned’; Recital 26 of the GDPR.