Netherlands

[NL] Interactive digital television provider ends data protection violations

IRIS 2016-9:1/24

Ronan Ó Fathaigh

Institute for Information Law (IViR), University of Amsterdam

On 12 August 2016, the Dutch data protection authority (Autoriteit Persoonsgegevens - AP) announced that a provider of interactive digital television, XS4ALL (a subsidiary of KPN), had ended a number of practices which violated the Dutch Data Protection Act (Wet bescherming persoonsgegevens - WBP) (for a previous decision, see IRIS 2015-7/25). The AP also published the conclusions of its investigation into the practices of XS4ALL’s digital interactive television in a 104-page report.

The AP found that KPN and XS4ALL process data about the viewing behaviour of customers in a number of ways, including when customers (a) subscribe to its service; (b) watch (linear) television through a set top box; (c) watch (linear) television through a website; (d) use the interactive options such as video-on-demand, and watch programmes at times outside of the regular schedule, such as delayed or forward watching; and (e) use personal storage space on the servers of KPN (network video recorder).

The AP stated that “data about the viewing behaviour, and the data that are related to it, are personal data”, as defined in Article 1(a), of the WBP. The data was also “data of a sensitive nature, which may provide an intrusively revealing overview of someone's behaviour and interests”. AP then examined a number of the practices.

First, in relation to the creation of television ratings, KPN collected and stored personal data about television viewing behaviour via the set top box for a period of 60 days until October 2015. KPN translated this data into television ratings, to be able to negotiate with the broadcasting organisations and to determine the channel package. Moreover, XS4ALL extracted data from its webserver to create WebTV ratings until March 2016, and provided the ratings to SKO (a foundation created by content providers in the Netherland). The AP found that “because of the sensitive nature of the data about the TV viewing behaviour, and because of the lack of guarantees such as adequate information, effective (immediate and irreversible) anonymisation, or an opt-out possibility, the interests of KPN and XS4ALL to generate TV ratings did not prevail over the right of data subjects to the protection of their private life (as laid down in Article 8, sub f, of the Wbp)”. However, KPN has now ended the processing of personal data to generate ratings about TV viewing via the Set Top Box, and XS4ALL has stopped providing these ratings to SKO.

Second, in relation to video-on-demand, KPN stored detailed information about the delayed viewing of television, previews of programmes and video on demand on an individually identifiable level in several log files, including the use of options such as the pausing and forwarding of programmes. The AP found that “because of the lack of guarantees such as anonymisation, adequate information, and an opt-out possibility, because the retention period was longer than necessary, and because data about viewing behaviour is data of a sensitive nature, the interests of KPN and XS4ALL to collect data about the viewing behaviour of video-on-demand and to process this data into ratings did not prevail over the right of data subjects to the protection of their private life”. Therefore KPN and XS4ALL had also infringed the WBP in this regard. However, KPN and XS4ALL now only process data about viewing behaviour “for technical, strictly necessary purposes”, with additional anonymisation.