Enschede Counted Shoppers by Tracking Their Phones, and Regulator Just Lost the Case
For two years, sensors in Enschede's shopping streets logged the wifi signals of passing phones to measure crowds. The court left the key question of whether that broke privacy law unanswered.
See more of Dutch Brief in your Google search results
For two years, the city of Enschede quietly logged the phones of people walking through its shopping streets. This week the country’s highest administrative court, the Council of State (Raad van State), ruled that the city does not have to pay a 600,000-euro privacy fine for doing so. But the judgment is more limited than it might first appear, and it does not settle whether the practice was lawful.
What Enschede did
To get a picture of how busy its city centre was, Enschede decided to run a continuous count of passers-by. From May 2018, it used at least ten sensors in the shopping streets, supplied by a specialist people-counting firm. These picked up the wifi signal of any phone that had wifi switched on, reading its MAC address, a unique identifying code assigned to a device’s network card.
Each phone was registered separately. By recording which device passed which sensor over time, the city could count unique visitors and see the routes people took. The data was scrambled into a pseudonymised code, and from 2019 the last three characters were cut off, with filters to remove residents and people whose phones randomised their address. Enschede stopped the counting in May 2020. Over the period, hundreds of thousands of people passed through the sensors’ range.
Why the regulator objected
After complaints from three members of the public, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, or AP) investigated and concluded that the city had broken European privacy rules. Counting phones is one thing, the regulator argued, but keeping track of which phone passes which sensor over a longer period turns counting into following people.
The AP’s core point was that combining a unique code with location data makes it possible to single out an individual and reveal patterns in how they live and move, which brings it within the definition of personal data under the GDPR, even if the code is pseudonymised. Because the city had no legal basis for processing this data, and did so structurally and for an unnecessarily long time, the AP imposed a fine of 600,000 euros in March 2021.
SPONSORED
You’re overpaying your accountant. And they still don’t call you back.
Neno gives you a dedicated bookkeeper, automated admin, real-time financial insights and a free business bank account. Everything your business needs, in one place.
No chasing. No surprises. No unnecessary costs.
What the court actually decided
This is where the case is easily misunderstood. Enschede challenged the fine, and in 2024 the district court in Overijssel scrapped it. The AP appealed to the Council of State, which this week sided with the lower court and confirmed that the fine is off the table.
Crucially, though, the court did not rule that wifi-tracking is permitted. It upheld the cancellation on a narrow, procedural ground: the AP had not properly proven its case. The lower court had found that the regulator leaned on assumptions, for example about the range of the sensors, rather than on investigated facts, and that it had not adequately shown that a real person could actually be identified from the data. Under privacy law, the regulator was required to examine whether it was reasonably likely that someone would in fact be identified, taking into account the effort, cost and time involved. It had not done so to the required standard.
In its appeal, the AP tried a different argument, that people were already identified simply because the city could count unique visitors. But the Council of State refused to consider it, because the regulator had not made that argument when it originally issued the fine, and a watchdog must prove its case at the point of the decision, not invent a new basis for it later. For that reason, the court said, it was leaving the central question undecided.
Why it matters
The upshot is that Enschede keeps its money, but the bigger question hangs in the air. The judgment turns on how the regulator built and argued its case, not on a green light for tracking people’s phones in public. Legal experts had already noted before the ruling that any municipality using wifi-tracking to count visitors is taking a legal risk while the law remains unsettled, and this decision does not remove that risk.
It also leaves a live tension for city centres across the country. Many municipalities have wanted to measure how busy their streets are, and wifi sensors are a cheap, automatic way to do it. Critics point out that the same thing can be done in less intrusive ways, including simply having people count passers-by at set times. For now, the question of where accurate crowd data ends and the surveillance of ordinary shoppers begins has been left for another case to answer.