Mobile Provider Responses to Mobile Privacy Action

Background

In May 2013 an article[1] was published in the Sunday Times claiming that research company Ipsos MORI had obtained the personal subscriber and communications data of EE customers and was attempting to sell it to other organisations, including the Metropolitan Police.

Both EE[2] and Ipsos MORI[3] released statements that said that the data was anonymised and could not be used to identify individuals.

Email Tool

ORG has created an email tool for people to contact their mobile provider asking them to them to:

  • make it clear whether they sell on their customers' data and what form that data is sold in
  • explain how people who buy that data could use it
  • say whether they're anonymising their customers' data and how they're doing that
  • allow customers to opt-in or opt-out of their data being sold like this

Message Template

The default message template to mobile providers was as follows:

Following the story in the Sunday Times last week about EE selling data about their customers to the research company Ipsos MORI, I have some questions about how you use my data.
1. Can you clear up what sort of customer data, if any, you are selling to other companies?
2. Do you sell customer data that has been anonymised? If you do, how do you anonymise the data to make sure individuals can't be re-identified?
3. I would also like you to give me the opportunity to control the reuse of my data, for example with an opt-in or opt-out mechanism. Is this possible?
Thanks a lot for taking the time to respond to my questions.

Mobile Providers' Responses to Customers' Emails

EE

Hello,

Thank you for contacting EE in regards to customer data protection. Recent news reports suggesting we sell personal information are not true. We’ve answered your questions below and you can also read our full press statement and Q&A here: https://explore.ee.co.uk/our-company/newsroom/ee-and-personal-information

Best regards,

Madeleine Leary Senior Responsibility Manager EE

1. Can you clear up what sort of customer data, if any, you are selling to other companies?
We are able to provide historical reports from our database about mobile network usage of large groups of customers. These reports analyse how, when and where our network is being used by these large groups and what it is being collectively used for. The data is based on groups of 50 people or more. It may contain, aggregated information about gender mix, age groupings, web trend activity and location trends. In most cases, these will be large groups of more than 1,000 mobile users. EE does not sell any individual customer’s personal data.

2. Do you sell customer data that has been anonymised? If you do, how do you anonymise the data to make sure individuals can't be re-identified?
All data shared is anonymised and aggregated so that it is not possible to identify an individual. EE anonymises data in accordance with industry standard and the ICO Anonymisation Code of Practice as appropriate to the data in question. In addition, where EE prepares market research reports for third parties, any data is not just anonymised, but also aggregated to such a level that individuals cannot be identified.

3. I would also like you to give me the opportunity to control the reuse of my data, for example with an opt-in or opt-out mechanism. Is this possible?
EE’s Privacy Policy explains what data we collect and how it is used at http://explore.ee.co.uk/privacy. This includes information on how to opt out of receiving marketing communications. As market research that is shared with third parties is anonymised and aggregated, and it is not possible to identify an individual, we currently don’t offer an opt-out for - network level data.

O2

Hello

Thanks for your email about how we use your data, please find some information about this below.

Can you clear up what sort of customer data, if any, you are selling to other companies?

The simple answer is that we don’t sell customer data.

As a leading digital services company we hold a range of customer information to both ensure a good service for our customers but to also fulfil our legal obligations as a service provider. But we don’t sell customer data on. You may have heard of “data analytics”. In 2012 we announced a data analytics business which included a product called Smart Steps. This is a data analytics tool which can help retailers, local councils, sporting venues and other organisations to measure and understand the number of people visiting an area. Smart Steps is about measuring the size of anonymous crowds of people - this does not include the selling of any individual customer’s data and it will never be possible to identify an individual customer.

Do you sell customer data that has been anonymised? If you do, how do you anonymise the data to make sure individuals can't be re-identified?

As described above, we don’t sell customer data. Smart Steps extrapolates trends from anonymised and aggregated data. Customers’ personal information is never sold or disclosed. Maintaining customer privacy is at the heart of the Smart Steps. An individual customer’s identity is removed. Their age and gender is then aggregated with other customers’ anonymised data and trends are extrapolated from the combined data. It provides a scientifically calculated estimate of the number of people from the total UK population who are in the area. This calculation is based on a count of the number of O2 customers, but the count of O2 customers is not shared.

I would also like you to give me the opportunity to control the reuse of my data, for example with an opt-in or opt-out mechanism. Is this possible?

With Smart Steps, there is no disclosure of a customers’ personal identity to “opt out” from. Smart Steps is about trends and crowds, not individuals and personal data. This in line with UK and EU data protection legislation which recognises that aggregated, anonymous data is no longer “personal data”. It is like the Census, or to use another analogy, an election. It is possible to see how many votes candidates or parties receive, and what the ‘swing’ was from the last election, but you never find out who an individual votes for in the privacy of the ballot booth.

We hope this helps.

Kind regards

O2

Vodafone

Good Afternoon,

Further to our previous correspondence, I would like to confirm the following:

Trust is essential to Vodafone’s business, and the protection of our customers’ privacy is essential to sustaining that trust. Vodafone is evaluating analytics projects, and we’re aware that these types of activities can only succeed if customers have control over how their data is used and feel that they receive some value in return. While we believe that anonymisation and aggregation are important steps in protecting data, we are also in the process of developing better tools to enable customers to make informed choices about their participation in these types of projects.

There are two legacy analytics projects we are engaged in that involve data generated about our general customer base. We participate in an industry-wide initiative started in the UK in 2008 to provide mobile audience web and app measurement for publishers and advertisers. This programme is run by our mobile industry trade association, GSMA, in association with ComScore. It was discussed and agreed with the UK’s Information Commissioner, it is based on a secure process regularly audited by the Audit Bureau of Circulations (ABC) UK, and it uses irreversibly anonymised census-level data.

Link - http://www.comscore.com/Products/Audience_Analytics/GSMA_Mobile_Media_Metrics_MMM

Our other legacy project is an association with TomTom, announced in 2006, where we provide them with high-level location data associated with a random temporary identifier for each phone which is changed every hour. This information is used by TomTom to help drivers identify traffic hotspots and road problems based on how many mobile devices are in an area at the same time. We hope that this addresses any concerns you may have regarding your data.

Kind regards Kayla Moss Directors Office Vodafone

Three

Thank you for your recent enquiry about the sharing of customer data.

We have received a number of similar enquiries from consumers who have been prompted to contact us following press reports or by the Open Rights Group campaign.

We know that data privacy is of utmost concern to our customers and we can confirm that Three does not sell customer data. There may be circumstances where information is shared with third parties, such as service providers who help us deliver services to customers, or deliver services that the customer has subscribed to directly, but there are always be carried out in full compliance with privacy laws.

If you require further information concerning the way we use personal data at Three, please see our Privacy Policy and Terms and Conditions which can be accessed at www.three.co.uk .

You can exercise your preferences in relation to marketing via My3 or by calling the contact centre on 333 from your mobile phone or 0843 373 3333 from another phone - normal call charges would apply.


Cat Cameron Executive Office Administrator

Virgin Mobile

Thanks for getting in touch. I can confirm that Virgin Media does not sell customer data. As such, we do not have an opt-in/opt-out policy.

I hope this answers your question.

Graeme Oxby

Tesco Mobile

Thank you for your email to our CEO, Roger Fogg. I understand that you would prefer a personal response from Mr Fogg, however due to the nature of his role; he is unable to respond to each customer query personally. Please be assured he is made aware of all contact received into his office and updated.

In answer to your questions-

"Tesco Mobile does not sell or pass on any customer data or anonymised data externally. We do at times use our customer information internally to understand shopping behaviours and to develop and improve our products and services”.

I hope this clarifies the matter for you, If you have any further queries relating to this matter, please email HLC_Telecoms@UK.Tesco.com

Thank you for contacting Tesco Telecoms.


Kind Regards,

Lisa Murray Tesco Telecoms

Mobile Companies' Privacy Policies

These are selected sections from mobile companies' privacy policies that are relevant to how sales of customer data for research and analytics purposes by by third parties.

EE

http://explore.ee.co.uk/privacy

2. YOUR PERSONAL INFORMATION

Your personal information is any information that identifies you as an individual or is capable of doing so.

We collect your personal information such as:

  • how you use our products and services. This may include your traffic data such as the phone numbers that you call and send messages to (and the phone numbers that you receive calls and messages from) and the date, time, duration and cost of your communications including your phone location at the time these communications are made and the types of websites that you visit, your spend, your device details, your phone usage (including voice, messaging, web/ WAP use, application use), your purchasing habits, your location, your searching and browsing history on our websites (including the date, time and duration of your internet session) and your preferences.

3. HOW WE USE YOUR PERSONAL INFORMATION

We use your personal information for the following purposes:

  • to provide aggregated statistics about our sales, customers, traffic patterns to third parties, but these statistics will not include any information that is likely to identify you
  • to carry out research and analysis and monitor customer use of our network and products and services on an anonymous or personalised basis to identify general consumer trends and to understand better our customers’ behaviours and partner with other businesses to create new services and to develop interesting and relevant products and services for our customers, as well as personalise the products and services we offer you. We may use information about your location for research and analytics purposes but we will only retain this information in an anonymised form to ensure that you cannot be identified as an individual.
  • to market and advertise our branded products and third party products and services that may be of interest to you including third party offers, promotions, advertisements, competitions or commercial communications by telephone (mobile and landline when available), post, fax, electronic messaging (including SMS and MMS), email or online or via any other interactive media. To do so, we may use the services of our trusted business partners. We may also use information about your location as a factor in deciding which mobile ads to serve to you.

4. SHARING AND DISCLOSING YOUR PERSONAL INFORMATION

We may share your personal information with:

  • our trusted business partners for research purposes, to identify and understand general consumer trends and to understand better our customers

O2

http://www.o2.co.uk/termsandconditions/privacy-policy

"The type of Information we have:

Who you are, which includes:

  • Your name, address, gender, age, interests and such.
  • You can find these in your MyO2 under My Details
  • Your debit or credit card details, bank details and other payment information

What you use your O2 products and services for: Your call, text, surfing and billing records (for example) Or any other products from us you use, like our apps - this includes the date and time you use them, how long for, where you use them and how much it costs. We don't look at the content of your messages or listen to your calls (unless you are talking to one of our customer service advisors).

Where you use our network:

So we can connect you to our network, we need to know your location when you make or receive phone calls, messages or use the internet. We call this network location, it finds you through phone masts nearby and only knows roughly where you are so that we can put calls through or connect you to the Internet.

Your smartphone might have also a Global Positioning System (GPS) location (...) We don't use your GPS location for calls, messages or internet access, generally. It's only if you're using some of our apps, like Priority Moments, that we might collect some of your GPS location information.

What you do with your O2 account(s):

This includes things like when and how much you top up and pay your bill or how often and why you access your account with us.

How you use O2 Money:

For example: what you use O2 Money products and card services for. And what payments and transactions are going through at shops and with our partners.


We use and analyse your information to keep in touch with you and to supply and improve our products and services. Sometimes we'll aggregate and anonymise this information so you won't be identified as an individual.

  • Tell you if we've changed the way a service works. Or tell you about a new service that we think may interest you
  • Check what you're interested in, so we can offer (and develop) products and services you're actually interested in
  • Look at markets. Write reports. Do research and number crunching. And (if the law allows it) look at information about you (including the calls you make, your spending, what you use the internet for and where you are when you do it). As an individual or as a group
  • Send you information about our products and services (or those from chosen third parties we think you'd be interested in).By phone, post, email, text, picture message, online banner advertising, or other ways – unless you opt out
  • Tell you about products and services from other companies we think you'd be interested in, or let chosen third parties tell you directly about their products and services. You can opt out of messages like this too"

The following is O2's privacy statement as it was in June 2013. It has since changed to the above text. 

"3. The Information We Collect

We collect such information as:

  • your use of products and Services including but not limited to phone numbers and/or email addresses of calls, texts, MMS, emails and other communications made and received by you and the date, duration, time and cost of such communications, your searching, browsing history (including web sites you visit) and location data, internet PC location for broadband, address location for billing, delivery, installation or as provided by individual, phone location;

4. How We Use Your Information

We may use and analyse information about you in order to:

  • analyse markets and produce reports, perform research and statistical analysis and to monitor usage behaviour (including when you are no longer an O2 customer);
  • disclose your personal information or usage of our services to certain third parties. See Disclosure of Your Information;
  • aggregate information about you, your spending and your use of the Services with information about other users of the Services in order to identify trends ("Aggregated Data"). We may pass Aggregated Data to third parties, such as advertisers, content providers and business partners or prospective business partners, to give them a better understanding of our business and to bring you a better service. Aggregated Data will not contain information from which you may be personally identified.
  • analyse information about you including your calling, searching, browsing and location data on a personalised or aggregated basis. We may pass this data to the third parties mentioned in (xx) above and we may use this information to provide you with targeted O2 or third party offers, promotions, adverts or commercial communications.

5. Disclosure of your Information

We may disclose your information:

  • to other communications companies;
  • to third parties for checking details of job applicants and employees;
  • to third parties from whom you have chosen to receive marketing information."

Vodafone

https://www.vodafone.co.uk/about-this-site/our-privacy-policy/index.htm

The personal information we collect

We’ll also get information on how you use our products and services, such as:

  • Your website browsing information (which includes information about the websites you visit, and about how you use our website or other Vodafone Group websites on your mobile or a PC)
  • The date, time and length of your internet browsing, and your approximate location at the time of browsing

Using your personal information

We may use and analyse your information to:

  • Let you know about other companies' products and services (including offers and discounts we’ve specially negotiated for our customers) we think may interest you, if you’ve chosen to receive this information
  • Understand how you use our network, products and services. That way, we can develop more interesting and relevant products and services, as well as personalising the products and services we offer you
  • Carry out research and statistical analysis to monitor how customers use our network, products and services on an anonymous or personal basis

The information we use will be your approximate location, based on the nearest mobile cell site. As a result, this will change as you move around with your mobile phone.

We’ll store your information for as long as we have to by law. If there’s no legal requirement, we’ll only store it for as long as we need it.

Sharing your personal information

We may share information about you with:

  • Companies in the Vodafone Group (Vodafone Group Plc and any company or other organisation in which Vodafone Group Plc owns more than 15% of the share capital)
  • Partners or agents involved in delivering the products and services you’ve ordered or used
  • Credit reference, fraud prevention or business scoring agencies, or other credit scoring agencies
  • Debt collection agencies or other debt recovery organisations
  • Law enforcement agencies, regulatory organisations, courts or other public authorities if we have to, or are authorised to by law
  • Emergency services (if you make an emergency call), including your approximate location

We may also share your information with partner organisations we’ve chosen carefully, so they can contact you about their products and services if you’ve agreed to this.

Vodafone Global Enterprise

Vodafone does not seem to share customer information with third parties. They appear to do their mobile analytics in house with Vodafone Global Enterprise.

Three

Pay Monthly

http://www.three.co.uk/_standalone/Link_Document?content_aid=1220457053001

"13.5 Your Information"

"(a) By “Your Information” we mean information that you give us or that we obtain about you as a result of any application or registration for, and use of Three Services. It may include your name, current and previous address(es), date of birth, telephone and fax numbers, gender, email address, employment and lifestyle information, bank and credit or debit card information, and information obtained from credit reference and fraud prevention agencies, marketing organisations and those who provide services to us, and may include information from other countries."

13.6 Use of “Your Information”.

We may process “Your Information” for a number of purposes including:

b) Account and Service Management.

  • (iii) for TrafficSenseTM and billing management; [ see note below ]

(c) Marketing and keeping you informed

  • i) to carry out analysis of your information, in order to develop our relationship with you, to develop and personalise Three Services and to present and deliver these to your Device;
  • (ii) to keep you informed about Three’s services, developments, pricing tariffs, special offers, and any discounts or awards which we believe may be of personal interest to you, or which you may be entitled to. We may keep you up to date directly to your Device, and by post, telephone and by electronic messaging such as phone text and picture message, email voice, audio and videomail subject to any preferences indicated by you. You can contact us at any time to ask us not to use your location or “communications data” for marketing purposes or if you would prefer not to receive direct marketing information, or simply to update your preferences by writing to or calling Customer Services, by sending an email to preferences@3mail.com or by updating your marketing preferences directly from your Device or online using My3;
  • (iii) to tell you about the products and special promotions of carefully selected partners (subject to your preferences) and allow you to receive advertising and marketing information from them but without passing control of your information to the third party concerned. You can update your preferences at any time as described above;
  • (iv) to carry out market research;

TrafficSense is Three's network traffic shaping system and not the British location analytics company of the same name.

Pay as you go

http://www.three.co.uk/_standalone/Link_Document?content_aid=1220457052786

"13.5 Your Information"

(a) By “Your Information” we mean information that you give us or that we obtain about you as a result of any application or registration for, and use of Three Services. It may include your name, current and previous address(es), date of birth, telephone and fax numbers, gender, email address, employment and lifestyle information, bank and credit or debit card information, and information obtained from credit reference and fraud prevention agencies, marketing organisations and those who provide services to us, and may include information from other countries

(b) While you are a customer of Three, we will also acquire and process information about your use of Three Services, including Location Data, your Communications Data, your phone telephone number, the unique code identifying your phone and SIM, and your account information including contact history notes

(c) Some of the information we collect about you may be classified as “sensitive” (such as visual or hearing impairments) and we will ask your permission if we wish to use or share this information

13.6 Use of “Your Information”

We may process “Your Information” for a number of purposes including:

  • (iii) to tell you about the products and special promotions of carefully selected partners (subject to your preferences) and allow you to receive advertising and marketing information from them but without passing control of your information to the third party concerned. You can update your preferences at any time as described above;
  • (iv) to carry out market research;

Giffgaff

http://giffgaff.com/boiler-plate/privacy

3. The information we collect

We collect such information as:

  • ix. Your use of the Services including but not limited to phone numbers and/or email addresses of calls, texts, MMS, emails and other communications made and received by you and the date, duration, time and cost of such communications, your searching, browsing history (including web sites you visit) and location data, internet PC location for broadband, address location for billing, delivery, installation or as provided by individual, phone location;

4. How We Use Your Information

We may use and analyse information about you in order to:

  • vii. Analyse markets and produce reports, perform research and statistical analysis and to monitor usage behaviour;
  • x. Inform you of any products and Services offered by other companies that we think may be of interest to you, provided that you choose to receive this information;
  • xi. Disclose your personal information or usage of our services to certain third parties. SeeDisclosure of Your Information;
  • xiii. Aggregate information about you, your spending and your use of the Services with information about other users of the Services in order to identify trends ("Aggregated Data"). We may pass Aggregated Data to third parties, such as advertisers, content providers and business partners or prospective business partners, to give them a better understanding of our business and to bring you a better service. Aggregated Data will not contain information from which you may be personally identified.
  • xiv. Analyse information about you including your calling, searching, browsing and location data on a personalised or aggregated basis. We may pass this data to the third parties mentioned in (xi) above and we may use this information to provide you with targeted giffgaff or third party offers, promotions, adverts or commercial communications.

5. Disclosure of your Information

We may disclose your information:

  • iv. To third parties from whom you have chosen to receive marketing information.

Virgin Mobile

http://www.virginmobile.com/vm/genericContent.do?contentId=security.and.privacy.footer.sm010

Disclosing your information

  • We may use aggregate information and statistics for the purposes of monitoring usage of our services in order to help us develop our services, and may provide such aggregate information to third parties, for example, content partners and advertisers. These statistics do not include information that can be used to identify any individual.
  • We will not pass on your personal information to third parties except in accordance with this policy and our Terms and Conditions or where we are required to disclose that information in order to comply with any legal or regulatory requirements.

Marketing our Products and Services

  • We may also, subject to your consent, use your personal information to contact you with information about special offers and rewards. Additionally, we may, subject to your consent, disclose your personal information to other Virgin companies so that they can contact you with information about their products and services. But don't worry, your details won't be shared with companies outside the Virgin group for marketing purposes without your consent.

Tesco Mobile

Pay Monthly

https://phone-shop.tesco.com/tesco-mobile/about-us/terms-paym-privacy.aspx

1. Using your information

1.2 We may use and share your information, information relating to the provision of Tesco Mobile Pay monthly Service, and other information about you available to us to identify you and consider your application, provide you with Tesco Mobile Pay monthly Service, conduct research on your use of Tesco Mobile Pay monthly Service to help us make informed business decisions, and inform you about Tesco Group products and services.

5. Sharing your information

5.1 We may pass your information to other members of the Tesco Group. We will never pass your information to anyone-else, except where we have your permission, where we are required or permitted to do so by law, to other companies who provide a service to us and any successors in title to our business. Your information will never be released to companies outside the Tesco Group for their marketing purposes.

Pay as you go

https://phone-shop.tesco.com/tesco-mobile/about-us/terms-payg-privacy.aspx

3. Disclosures of your information

We would like to reassure you that your details are safe and will never be released to companies outside the Tesco Group for their marketing purposes.

We will share your details among Tesco companies at home and abroad (e.g. Tesco Personal Finance) and businesses that process this information on our behalf (e.g. printers who need certain details to print mailings).

We may also use and share information relating to groups of customers, without identifying individuals, to learn more about customer behaviour and find ways of enhancing our service.

TalkTalk

http://www.talktalk.co.uk/legal/privacy-policy/?utype=talktalk

How your personal information is used by TalkTalk Telecom Limited

We may also use your information for research and statistical analysis with the aim of improving our services.

We may use the personal information we collect from you to build up a profile of your interests and preferences. This information may be disclosed to other companies in the TalkTalk Group Limited group of companies and carefully selected third parties and/or used to make you aware of products or services that you may find of interest. If you do not wish your details to be used for the purposes described above, please write to us c/o The Data Controller, TalkTalk Telecom Limited, 11 Evesham Street, London W11 4AR stating your full name, address, account number and mobile phone number. Please note: this will not affect any marketing consent which you have already given in respect of agreements relating to other products and/or services.

References

  1. ↑ Secrets of 27m mobile phones offered to police, Sunday Times, 2013-05-12
  2. ↑ EE press release, 2013-05-13
  3. ↑ Ipsos MORI press release, 2013-05-12
Retrieved from "https://wiki.openrightsgroup.org/w/index.php?title=Mobile_Provider_Responses_to_Mobile_Privacy_Action&oldid=42463"