You can only process traffic data (eg information about the routing, duration or timing of a message) for limited purposes with the authority of the network or service provider.
You must tell customers if you keep their traffic data, and get their consent before using it for marketing or value-added services. You must erase or anonymise it as soon as you have finished with it (unless another law requires you to keep it).
In more detail…
- What is traffic data?
- What are the rules on traffic data?
- Who needs to comply?
- What can we use traffic data for?
- What information must we give customers?
- When do we need consent?
- What counts as consent?
- How long can we keep traffic data?
Traffic data is defined as:
“any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing in respect of that communication and includes data relating to the routing, duration or time of a communication”.
This includes information about the routing or timing of any phone call, text or email, whether it relates to an individual or a company.
The focus here is on data collected and processed by a public communications provider. It is not likely to include data collected by another party via another route (eg data collected directly from nearby mobile devices by an organisation’s wi-fi equipment).
The rules on traffic data are in regulations 7 and 8. Only public communications providers, or those acting under their authority, can process traffic data. In summary, if you are processing traffic data, you must:
- only use it for permitted purposes;
- give your customers information about the processing;
- get their consent for certain uses of the data; and
- erase or anonymise it as soon as you have finished with it (unless another law requires you to keep it).
There is an exemption for emergency alerts where a relevant public authority needs to warn, advise or inform users or subscribers of an emergency in their location (regulation 16A).
The relevant public communications provider has ultimate responsibility for complying with these rules. If you are a network or service provider and are using a third-party data processor to process traffic data on your behalf, you need to take steps to ensure they comply with PECR. In particular, you should have a written contract setting out what the data processor is allowed to do.
This ties in with the seventh data protection principle for processing personal data – but remember that to comply with PECR the contract needs to cover the traffic data of corporate subscribers as well as the personal data of individuals. See our separate Guide to data protection for more information on the seventh principle.
However, anyone else processing traffic data without proper authority would also be in breach of PECR.
Network providers can only process traffic data:
- to manage billing or traffic;
- to handle customer enquiries;
- to prevent or detect fraud.
Service providers can also process traffic data:
- to market electronic communication services (with consent);
- to provide a ‘value-added service’ (with consent).
The processing must be restricted to what is necessary for these activities. However, PECR do not prevent you providing traffic data to Ofcom or any other authority that has statutory authority to resolve disputes.
You must give the relevant subscriber or user information about the type of traffic data you will be processing for billing, marketing or value-added services, and how long you will keep it.
This ties in with the transparency requirements of the first data protection principle (privacy notices), which also applies if you are processing traffic data about individuals. See our separate Guide to data protection and our Privacy Notices Code of Practice for more on privacy notices.
You need consent if you want to use or store someone’s traffic data for marketing purposes, or to provide any value-added service.
‘Marketing’ in this context is not limited to direct marketing by phone, text or email. For example, it may also include using traffic data to analyse a customer’s usage patterns to offer alternative tariffs.
A ‘value-added service’ is defined as:
“any service which requires the processing of traffic data or location data beyond that which is necessary for the transmission of a communication or the billing in respect of that communication”.
This may, for example, include an email content-filtering service offered by an internet service provider, which monitors traffic data to scan incoming emails. It may also include a mobile network operator using their customers’ traffic data to target advertising.
You will not be able to rely on a blanket ‘catch-all’ statement on a bill or website, and should get separate consent for marketing and for each value-added service requested. The clearest way to obtain consent is to use opt-in boxes. If you want to rely on implied consent (eg consent is implied when subscribing to a service), you must include a clear and prominent statement about the use of traffic data.
PECR also specify that you must get consent from the person who the data is actually about – who might be a subscriber or a user. For this reason it may not always be enough to rely on consent given by the subscriber in advance when they signed up to a contract, if someone else will actually be using the connection.
In the case of companies and other corporate subscribers (limited liability partnerships, Scottish partnerships and government bodies), you can accept assurances from a representative giving consent on behalf of the organisation, unless you have reasonable grounds to question their authority.
PECR specify that consent must be given to the provider. If the relevant value-added service is offered by a third party (with your authority), you should make it very clear that the traffic data will be passed to that third party. If the customer gives consent to a provider for a particular service, they should not then be surprised when they are contacted by a third party about that service.
Remember that the customer is entitled to withdraw their consent at any time, in which case you should immediately stop using the traffic data for marketing or value-added services.
The general rule is that you must erase or anonymise the data when it is no longer needed to transmit a communication – in other words, as soon as the message has been sent or the phone call has ended.
Of course, if the traffic data is still required for billing purposes, you will need to keep it longer in order to calculate charges. PECR say you can keep this billing data until the end of the period in which proceedings can be brought to challenge the bill or chase payment (including the period for appealing any decisions). In terms of contract law, this would usually mean a limitation period of six years (plus appeals time). However, in our view it will not usually be necessary to keep the data for this long. You should only keep it when the circumstances require this – for example, if the bill remains unpaid or has been challenged before being paid. You also need to have told the customer how long you plan to keep this data.
If you have consent to keep the traffic data for marketing or value-added services, you can only keep it for as long as is necessary for those purposes. Again, you also need to have told the customer how long you plan to keep it.
There is an exemption if another law requires you to keep the data for longer than this – for example, for national security or crime prevention reasons. You need to set up procedures for allowing access to the data in such cases. See the exemptions section of this guide for more information.
This regulation ties in with the fifth data protection principle, which requires that any personal data (including traffic data about individuals) must not be kept for longer than necessary. See our separate Guide to data protection for more information.