The Privacy and Electronic Communications (EC Directive) Regulations 2003

Restrictions on the processing of location data

14.—(1) This regulation shall not apply to the processing of traffic data.

(2) Location data relating to a user or subscriber of a public electronic communications network or a public electronic communications service may only be processed—

(a) where that user or subscriber cannot be identified from such data; or

(b) where necessary for the provision of a value added service, with the consent of that user or subscriber.

(3) Prior to obtaining the consent of the user or subscriber under paragraph (2)(b), the public communications provider in question must provide the following information to the user or subscriber to whom the data relate—

(a) the types of location data that will be processed;

(b) the purposes and duration of the processing of those data; and

(c) whether the data will be transmitted to a third party for the purpose of providing the value added service.

(4) A user or subscriber who has given his consent to the processing of data under paragraph (2)(b) shall—

(a) be able to withdraw such consent at any time, and

(b) in respect of each connection to the public electronic communications network in question or each transmission of a communication, be given the opportunity to withdraw such consent, using a simple means and free of charge.

(5) Processing of location data in accordance with this regulation shall—

(a) only be carried out by—

(i) the public communications provider in question;

(ii) the third party providing the value added service in question; or

(iii) a person acting under the authority of a person falling within (i) or (ii); and

(b) where the processing is carried out for the purposes of the provision of a value added service, be restricted to what is necessary for those purposes.