XS4ALL and KPN end privacy violations digital TV

The Dutch companies XS4ALL and KPN, providers of interactive digital television, have ended several infringements of the Dutch Data Protection Act [Wet bescherming persoonsgegevens], after an investigation by the Dutch Data Protection Authority [Autoriteit Persoonsgegevens, hereinafter: AP].The AP found that XS4ALL en KPN did not provide sufficient information to their interactive TV customers about the collection and processing of personal data about their TV viewing behaviour. KPN and XS4ALL created TV ratings without the prior consent of their customers, for the purpose of market research, while the ratings could still be linked to identifiable customers. This was in contravention of the law. The AP furthermore found that the companies stored customer data longer than necessary for the purpose for which the data were collected. XS4ALL and KPN have consequently modified their systems and the information in their privacy statements. The companies have also reduced the retention periods. Through these measures, partially taken during the investigation, all infringements of the law have been ended.

In the past, televisions only passively transmitted images. But through the connection of TVs to the Internet, watching TV has become a two-way street. Providers of interactive digital TV are able to watch the viewers, observe their behaviour and with that, create ratings about TV and video on demand.

Data about viewing behaviour can provide an overview of a person's behaviour and interests. They are personal data of a sensitive nature. The retention of TV viewing behaviour on an individually identifiable level may lead to people feeling embarrassed to watch certain channels or programs.

Providers may only further process these data (for other purposes than strictly technical purposes) if they provide clear and complete information to their customers. Only when customers have been sufficiently informed, are they able to indicate their agreement.

Privacy statements

The AP has concluded that XS4ALL and KPN did not provide clear information to their customers about the categories of personal data they collected and processed about the viewing behaviour, the purposes and the retention periods. Clear information is necessary to allow people to assess the impact of data processing, and to make a deliberate choice to use a service.

At the start of the investigation the privacy policy of XS4ALL did not contain any information about the digital TV service. As a result of the investigation, XS4ALL and KPN have redrafted their privacy statements. The AP has concluded however that the new privacy statements contained a sentence that the privacy policy could be changed any time. As a result of this conditional phrasing, customers could not rely on the described purposes of the data processing. Customers therefore still did not have sufficient control over the processing. Meanwhile the companies have again redrafted their privacy policies, thereby ending this infringement.

TV ratings

The investigation shows that KPN and XS4ALL had created TV ratings for market research, and provided ratings about viewed video on demand to the content providers. These ratings however were not anonymous, as long as KPN still had the original personal data in her systems. KPN and XS4ALL should have asked for the consent of their customers for these purposes. Because they did not, this processing was in contravention of the law.

Meanwhile, KPN and XS4ALL have modified their systems. Data about TV viewing behaviour are only processed for technical, strictly necessary purposes. The data about 'free' video on demand are only translated in ratings after a period of 30 days, after the original personal data have been deleted. This way, the ratings cannot be linked to individual persons anymore.