A city open Wi-Fi service logs device MAC addresses for ‘security analytics’ without discussing retention limits or other protective discipline. What GDPR security insight applies?
Select an answer to reveal the explanation.
Short Explanation
Calling it security analytics does not put the logs in a legal free-fire zone. If you collect identifiers, you still need to protect them and keep the handling tight—including how long they stick around. The shield you build for security must not become a messy pile of unprotected personal data.
Full Explanation
Even security-motivated collection of personal data—such as logging device MAC addresses for open Wi-Fi security analytics—requires appropriate protection and disciplined handling of the data collected, including retention limits. Labelling a purpose “security” does not exempt technical and organisational measures. MAC addresses used for security are not never personal data in the EU when they relate to an identifiable individual. Retention limits are not irrelevant whenever a purpose includes the word security. Exam caveat: security purposes still engage GDPR principles for the logs themselves. Operational check: define retention for civic Wi-Fi MAC logs, restrict analyst access, document the lawful basis, and delete or anonymise when the security purpose no longer requires identifiable logs. For municipal teams, keep a one-page decision note that states the governing instrument, why competing labels fail, and what evidence would change the conclusion. Document the decision trail so auditors can see how the civic team matched facts to the correct legal category rather than to a slogan. Revisit the conclusion when facts, recipients, or processing purposes change, and record who approved the updated analysis.