The National Commission for Computing and Liberties (CNIL) unveiled, on June 13, the launch of a study on geolocation data collected by mobile applications. This survey aims to raise awareness of the issues surrounding personal data. It follows the commission’s strategic plan for 2022-2024.
The CNIL wants to raise awareness about data collection
Raising awareness of issues related to the collection and use of personal data is a major challenge for the CNIL. It is in this context and within the framework of its roadmap, revealed a few months earlier, that its next study fits.
ByteDance, parent company of TikTok, recruits for VR-related projects
The commission identified a platform that connects sellers and buyers of data, which offers free samples from data brokers. For its investigation, it recovered an extract of these data corresponding to France. Thanks to him, the commission will analyze this personal data, presented by the retailer as completely anonymized.
Its purpose is to check whether, based on this dataset, it can identify who the data belongs to. If the examination is positive, it will take care of individually informing the persons concerned as a preventive measure. The study is expected to last 15 months.
Advertising identifier and geolocation
The sample recovered by the CNIL includes time-stamped geolocation data with location points associated with nearly 5,000,000 smartphone advertising identifiers. This information was collected over a period of approximately one week in 2021.
An advertising identifier allows advertisers to recognize a smartphone through a string of unique characters. Using this data, brands can serve users with targeted advertising based on phone location and data obtained from other installed apps. Thus, an advertiser will be able to offer advertisements corresponding to the places visited. The CNIL warns about this, “ the more this identifier is stable over time, the more information it allows to accumulate on the habits of smartphone owners. It is therefore advisable to renew this identifier regularly. “.
The Commission precise that ” in this study, the advertising identifier will only be used to make the link between the location points corresponding to the same smartphone. The value of the identifier will not be associated with other data as an advertising player could do “. The identification work will focus on advertising identifiers comprising at least ten location points, approximately 850,000 different identifiers are concerned.
In addition to the data from the sample, the CNIL intends to study publicly accessible data such as the open diaries of public figures, data on participation in parliamentary sessions, density maps of France, data from the universal directory and venues for public sporting events. None of them will be kept by the commission after the study.
If this investigation does not act as a control or sanction procedure, the CNIL “ verify the GDPR compliance of professionals in the sector [de la prospection commerciale]in particular those who resell data, including the many intermediaries in this ecosystem “.