1

As an employee of company A I would like to statistically analyse access logs of wifi access points, which are located in offices of company A, but managed by a service provider (company B). company B can access those logs remotely e.g. via a browser. company A has no access to that interface.

As far as I know, GDPR seems to allow processing of personal data for statistical purposes. So if company A would have access to those logs, they were legally allowed to process the personal data.

The biggest question for my use case therefore is if company B, as data holder of those access logs, is allowed to grant access to the access logs, to company A on the foundation of the EU Data Act.

As far as I see it seems like company B can not grant access to the access logs of those wifi access points as access points do not match the definition of a "connected product" according to the data act (Art. 2 No. 5):

(5) ‘connected product’ means an item that obtains, generates or collects data concerning its use or environment and that is able to communicate product data via an electronic communications service, physical connection or on-device access, and whose primary function is not the storing, processing or transmission of data on behalf of any party other than the user;

My interpretation of this definition in case of an access point is the following:

An access point is an item that obtains, generates or collects data (access logs) concerning its use and that is able to communicate product data (access logs) via an electronic communications service (HTTP interface for a browser), but whose primary function is transmission of data on behalf of any party (natural person who connects their devices to the access point) other than the user (company A);

Is this interpretation correct?

2
  • How is this set up? Surely B is not a private service provider serving kitten pics to random people happening to be in A's offices? What is the legal base of B having this data? Do they have a contract with each individual in A's offices that signed up for their services, or has A a contract with B and each individual working for A in the working contract has agreed to have their data used that way?
    – nvoigt
    Commented May 13 at 14:24
  • Let's assume "A has a contract with B and each individual working for A in the working contract has agreed to have their data used that way"
    – PSanetra
    Commented May 13 at 14:49

1 Answer 1

3

Depends on many details beyond the scope of an easy Q&A.

  • Is B the data controller or the data processor? The contract between A and B should spell this out.
  • Is wifi access provided to employees of A in the course of their work, or are members of the general public involved? Both produce different challenges. Collecting data on employee IT use may be construed as preventive maintenance on the company IT, or as illicit surveillance, depending on the specifics.
  • Is all the hardware provided by the company, or is it BYOD?
5
  • Oh I did not consider these questions yet. But I am also not sure if they are important if a wifi access point is not considered a connected product in the sense of the law. Do you think a wifi access point can be considered a connected device? As far as I see it does not match the "primary function" constraint. Do you see this differently?
    – PSanetra
    Commented May 13 at 17:06
  • @PSanetra, I would think that the issue of connected products should come up here. B is limited by their contractual relationship with A, A is limited by their relationship with the data subjects, and technical implementation details are not the point.
    – o.m.
    Commented May 13 at 18:43
  • I am not familiar with the terms "data controller" and "data processor": Both terms do not seem to appear in the data act legal text. Am I missing something? eur-lex.europa.eu/legal-content/EN/TXT/HTML/…
    – PSanetra
    Commented May 14 at 8:06
  • Ah I see. These are terms from GDPR. So if I understand correctly: If these roles are not properly defined in the contract, adressing GDPR, then there is no need in trying to apply data act law, right?
    – PSanetra
    Commented May 14 at 8:32
  • @PSanetra, trying to reason through this by google is irresponsible. If company A is affected by GDPR, the company should have a designated data protection officer and this officer should consult a lawyer.
    – o.m.
    Commented May 15 at 4:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .