Transport & Mobility — GDPR: protecting mobility data

What does GDPR cover?

GDPR applies to data linkable to a traveller: named tickets, location, journeys. Geolocation and travel histories are particularly sensitive as they allow inference of home address, workplace, and habits.

The data minimisation principle calls for limiting collection and retention.

Is the 'Transport & mobility' sector concerned?

Transport operators, ticketing managers and mobility service providers are data controllers. Third-party services (under the Data Act) are controllers for their own processing activities.

The purpose (transport pass, fraud prevention, service) determines the legal basis and minimisation requirements.

Detailed obligations

Sanctions & risks

Fines of up to €20M or 4% of global turnover. Geolocation and movement profiling are drawing the attention of supervisory authorities.

Common mistakes in the sector

• 1Excessive collection. Retaining detailed logs without necessity.
• 2Poorly governed geolocation. Tracking location without adequate information.
• 3Unregulated profiling. Profiling movements without a framework.
• 4Excessive retention. Retain data beyond what is necessary.

Practical case

A network was retaining nominative journey histories indefinitely. Following analysis, it defined retention periods, anonymised data beyond those periods, informed passengers and restricted use to fraud prevention purposes.

Compliance roadmap

1. 1

   Map. Map ticketing, geolocation and historical data.

2. 2

   Qualify. Verify legal bases and data minimisation.

3. 3

   Frame. Defining user information and control.

4. 4

   Secure. Strengthen security and retention periods.

5. 5

   Document. Maintain the register.

Frequently asked questions