What Does the GDPR Mean for WiFi Hotspots?

German users check their smartphones an average of 214 times a day. Even on vacation, in hospitals, at the doctor’s office, in shops, in restaurants, or at the library, they are reluctant to do without them. Those who fail to adapt risk losing customers. However, operators now face new obligations that come into force on May 25, 2018 under the GDPR. Not only are potential fines higher than before, but penalizing violations is no longer a matter of discretion—it is mandatory.

What must be considered in order to remain legally compliant? The login process is crucial, as this is where data is processed. Here are the most important criteria:

• Legal basis: No data processing without it! For example, if a room is booked with WiFi service, if a customer purchases a WiFi ticket, or if access is part of a club membership, an employment relationship, or university attendance, a legal basis exists for processing the booking data.
• Transparency and data minimization: Only data strictly necessary for the intended use should be processed, and no additional data intended for marketing purposes—especially not without the knowledge of the data subject.
• Data sharing: If data is transferred to third parties, the data subject must be informed and provide consent. Making free WiFi, such as in a spa, conditional on this consent is not permitted. The opt-in, such as for a mailing list of an affiliated cosmetics institute, must be granted independently of this service.
• Retention periods: The customer must be informed how long the data will be stored, and there must be an option to erase, rectify, transfer, or restrict this data upon request. Every operator is well advised not to retain personal customer data longer than necessary or legally required.
• Privacy policy: This is the appropriate medium for an operator to correctly fulfill their information obligation. It must explain in clear, comprehensible language what data is stored, on what legal basis, for how long, and whether it is transferred to third parties. In addition, contact information must be provided.

With IACBOX, you are certainly on the safe side regarding data privacy. IACBOX has always provided data-minimizing and privacy-friendly default settings as well as deletion and anonymization features. In addition, end-user privacy notices have now been updated and all login pages have been equipped with information on anonymization and deletion periods. The new add-on Privacy Toolkit module also offers options to create an individualized data processing register that takes into account specific login methods and database connections, as well as convenient options for privacy by design/default presets, confidentiality and data processing agreements, checks, help texts, and access logging.

You can find more information about the new Privacy Toolkit module here.

This article also appeared in IT-BUSINESS 4.2018.