Spanish Court Sides with Noyb in Appeal Over Access to Location Data

Noyb filed an appeal against the ruling from AEPA, Spain’s data protection authority, against Virgin Telco on June 22nd - a case that centered on the phone service provider’s rejection of a customer access request for their location data.

Based on an unexpected interpretation of the law, the AEPD sided with the business and limited the user's access rights - in conflict with their requirements under the General Data Protection Regulation (GDPR).

Location data, according to Noyb, is personal data, and must be made available as part of the right to access. 

Now, six months later, The Spanish court overturned the previous decision on location data by the Spanish DPA (AEPD).

Read more about this topic on the Noyb website.

The Right to Access Your Own Location Data

Some EU Member States, like Spain, continue to demand that mobile network operators store the data of all phone calls, short messages, and cell tower logins, in spite of numerous Court of Justice (CJEU) judgements that forbid these types of data retention.

The GDPR and the European Charter of Fundamental Rights both give everyone the right of request to access their personal data. Virgin Telco, a mobile phone operator, received a request for location data from a Spanish client who used his “right to access” right under the GDPR.

The business declined to release the information, claiming that only law enforcement would be given access to their stored location data for criminal matters.

The AEPD took Virgin Telco's side and came to the decision that no access to such data would be granted. 

In June 2022, Noyb filed a rebuttal to this ruling.

“The fundamental right to access is comprehensive and clear: users are entitled to know what data a company collects and processes about them - including location data. This is independent from the right of authorities to access such data. In this case, there is no relevant exception from the right to access.”  - Felix Mikolasch, Data Protection Lawyer at Noyb.

The AEPD reconsidered the initial stance and decided to support Noyb after taking into account their submission to the Court. Finally, the Audiencia Nacional upheld Noyb's arguments and overturned the Spanish DPA's earlier judgment.

"We are very happy about this court decision. Telecommunication location data will now hopefully be treated as personal data from the very beginning. We hope that other authorities also take this case into account", stated Felix Mikolasch, data protection lawyer at Noyb.

The matter will now be decided by the Spanish AEPD. The European Center for Digital Rights is hoping for a prompt release of the final ruling because the AEPD already supported Noyb during the appeal. An analogous appeal is still pending in Austria.