A European municipal visitor center will collect guest email addresses through the Wi-Fi captive portal for marketing. Which requirement should WLAN security policy work incorporate under GDPR?
Select an answer to reveal the explanation.
Short Explanation
Free Wi-Fi isn't a GDPR hall pass. If the portal grabs emails for marketing, policy has to spell out consent, why you need the data, and how little you'll keep—before the splash page goes live.
Full Explanation
A European municipal visitor center that collects guest email addresses through a Wi-Fi captive portal for marketing is processing personal data under GDPR. WLAN security policy work must therefore define consent (or another lawful basis), purpose limitation, and data-minimization expectations before marketing capture is enabled on the portal. Indefinite retention of every MAC address and email for vague future analytics violates storage limitation and purpose limitation. Skipping consent language because Wi-Fi is free is incorrect—gratis service does not remove GDPR obligations when personal data are collected. Mirroring the email list to an unsecured open SSID logging system expands exposure and undermines integrity and confidentiality of the collected data. Exam caveat: lawful basis may be consent for marketing or another basis for necessary network logs; the exam point is that portal data collection must be designed into policy up front, not bolted on after go-live. Operational check: review the captive-portal flow for clear consent and purpose text, confirm marketing fields are optional where required, verify retention schedules and deletion processes, and ensure portal backends are not on open or unmanaged logging paths.