"Find my device" and GDPR compliance

Question

Google and Apple both offer a "Find my Device" service which allows to track or even remotely wipe a stolen device. Yet some companies claim that tracking stolen devices is not a legitimate business reason under GDPR, e.g. TomTom:

EU Data Protection legislation states that companies are only allowed to record and keep personally identifiable information (such as GPS tracks and traces linked to a particular device) if there is a valid business reason for doing this. Since TomTom does not have such a business reason, we have made sure that our data processing operation does not maintain information regarding user-, or device locations in identifiable form. That means we cannot track a specific user or a specific device.

How is tracking a stolen GPS different from tracking a stolen phone?

Answer 1

It is not different. But one company can decide to approach compliance differently from another. Here, TomTom has chosen a fairly safe/conservative interpretation, whereas Google and Apple decided that more data collection is appropriate.

A “find my device” style functionality appears to be entirely unproblematic if the user books that particular service (regardless of whether the service is paid or gratis) and provides consent for the location data collection. The legal basis for such a service could then be Art 6(1)(a) consent or Art 6(1)(b) necessity for performance of a contract to which the data subject is party.

Personally, I believe that Google is not sufficiently transparent about how Find My Device works, but that TomTom could provide a compliant service if they wanted to. That TomTom doesn't offer this service primarily shows that they don't think developing this service is worth it.

Wiping a remote device is unrelated to this issue and doesn't seem to provide GDPR challenges. At least in a business context, remote wiping may be an appropriate security measure and may then even be mandated by the GDPR (e.g. see Art 24 or Art 32).