# Governing rich telecom data under GDPR, ePrivacy, and lawful intercept
At 9:14 on a Tuesday, three requests land on the same telecom operator's desk. Marketing wants to sell aggregated foot-traffic insights from subscriber location data. The national data retention rules say certain records must be kept for law enforcement. And a court has just issued a lawful intercept order for a specific customer's live communications.
All three touch the same underlying data. All three are governed by different, sometimes conflicting rules. Your job is to build a governance framework that keeps the business legal, the regulator satisfied, and the customer's rights intact.
This lesson walks through that reconciliation.
Telecom operators sit under a denser regulatory stack than most industries. Three regimes matter here.
GDPR (General Data Protection Regulation). The EU's baseline privacy law. It applies to any "personal data," meaning information relating to an identifiable person. It requires a lawful basis for every use, purpose limitation (you use data only for the purpose you collected it for), and data minimization.
ePrivacy Directive. A telecom-specific layer that sits on top of GDPR. It governs "traffic data" (who called whom, when, for how long) and "location data" (where a device is). The key rule: these are more sensitive than ordinary personal data and generally must be erased or anonymized once no longer needed for the call, unless a specific exception applies.
Lawful intercept and data retention obligations. National laws that require operators to keep certain metadata and to provide live interception capability to law enforcement under proper legal authority. In the EU these vary by member state, partly because the Court of Justice has repeatedly limited blanket retention.
The tension is structural. GDPR and ePrivacy push toward deleting and minimizing. Retention and intercept laws push toward keeping and disclosing. Governance is how you hold both.
Marketing's pitch sounds harmless: aggregate where crowds gather to sell "mobility insights" to retailers and city planners.
The problem is the starting material. Location data of an identified subscriber is protected under ePrivacy. You cannot simply repurpose it because it is convenient.
Your governance options, in order of safety:
Consent. Under ePrivacy, using location data for a value-added service generally requires the subscriber's prior, informed, freely given consent, with the ability to withdraw. Consent buried in a 40-page terms document does not qualify.
Anonymization. If you transform the data so no individual can be re-identified, even by combining datasets, it falls outside GDPR entirely. This is genuinely hard. Location traces are notoriously easy to re-identify because a person's home-plus-work pattern is nearly unique.
The practical test: does your "anonymized" output survive a re-identification attempt?
# Sanity check before releasing "aggregated" location data.
# Suppress any grid cell / time bin with too few distinct users.
K_THRESHOLD = 20 # min distinct users per aggregate
def is_safe_to_release(cell_counts):
# cell_counts: {(grid_id, hour): distinct_user_count}
return all(count >= K_THRESHOLD
for count in cell_counts.values())
# If any cell has fewer than K users, that row is
# too identifying. Suppress it, don't ship it.This is a crude form of kkThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.View full definition →-anonymity: never release an aggregate that describes fewer than KKThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.View full definition → people. It is a floor, not a guarantee, but it stops the most obvious leaks.
Governance decision: marketing gets aggregated, suppressed, non-identifying data, produced through a documented pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition →, with a data protection impact assessment on file. They do not get raw traces.
Now the opposite pressure. National law requires you to retain certain subscriber and traffic metadata so it is available if law enforcement later needs it.
Here is the nuance many operators miss. The Court of Justice of the European Union has repeatedly ruled that general, indiscriminate retention of all traffic and location data is not permitted in most circumstances. Targeted retention, retention limited to serious crime, and expedited "quick freeze" of specific data are more defensible.
You can read the Commission's overview of the ePrivacy framework on the European Commission ePrivacy page.
So retention governance is not "keep everything forever." It is:
The separation point is critical. The data you keep for law enforcement is not a resource the business gets to reuse. Purpose limitation means retention-purpose data stays walled off.
The court order is the sharpest instrument. It authorizes real-time interception of a named target's communications.
Lawful intercept is not a loophole in GDPR. GDPR explicitly steps aside for processing required by law enforcement under proper legal authority. But "proper" is doing heavy lifting.
Your governance controls:
Validate the order. Is it from a competent authority? Is it in the correct legal form? Does it name a specific target and scope? An operator that hands over data on a vague or improper request is itself liable.
Scope tightly. Intercept the named target only, for the authorized period, for the authorized data types. No fishing.
Standardized handover. Operators implement lawful intercept through defined technical interfaces (ETSI, the European Telecommunications Standards Institute, publishes the widely used standards). This keeps interception auditable and separate from normal network operations.
Separation of duties. A small, vetted lawful-intercept team handles these requests. Marketing, analytics, and general engineering never see them. This protects both the investigation and the operator.
Three requests, one dataset, one framework. The framework rests on five pillars.
Every dataset has registered, approved purposes. Location data may be tagged "network operation," "consented value-added service," and "legally mandated retention." A purpose not on the list cannot happen. Marketing's insights product must register a purpose and pass review before it exists.
For each purpose, document the legal basis. Consent for marketing analytics. Legal obligation for retention. Legal obligation plus proper court authority for intercept. If you cannot name the basis, you cannot process.
Physically or logically separate the three data pools:
Role-based access ensures no single team spans all three.
Deletion is not a policy document, it is a cron job. Each data category carries a retention clock. When it expires, the data is deleted or anonymized automatically, with the deletion logged. Manual deletion always drifts.
Every access to sensitive pools is logged: who, what, when, under what basis, under what order. When a regulator or a customer exercising GDPR rights asks "who touched my data," you can answer.
Knowledge check
1. What best describes the structural tension a telecom operator must reconcile between GDPR/ePrivacy and lawful intercept/retention obligations?
2. Why does the ePrivacy Directive treat traffic data and location data with stricter rules than GDPR applies to ordinary personal data?
3. Marketing wants to sell aggregated foot-traffic insights derived from subscriber location data. What is the key governance concept that determines whether this is permissible under the described regimes?
4. Select ALL correct answers about the roles of GDPR and the ePrivacy Directive in the telecom regulatory stack.
Select all the correct answers.
5. Select ALL correct answers about lawful intercept and data retention obligations as described in the lesson.
Select all the correct answers.
Frameworks are tested at the edges. Three common collisions:
Marketing wants the retention data. No. Retention data has a single legal purpose. Purpose limitation forbids reuse. The framework's segregation makes this technically impossible, not just discouraged.
A customer files a GDPR erasure request while under a retention obligation. The erasure right is not absolute. Data you are legally required to retain is exempt from deletion. But you delete everything outside that legal minimum, and you document why the rest stays. You do not use "we might need it" as cover.
An intercept target files a data subject access request. GDPR allows restricting a subject's access when disclosure would prejudice an active investigation. The lawful-intercept regime and national law govern here. Your framework routes such requests to legal, not to the standard automated response.
The pattern across all three: the framework decides, not the loudest stakeholder.
This is not only compliance hygiene. Regulators can impose significant fines under GDPR, and telecom regulators have their own sanction powers. Beyond fines, trust is a telecom asset. Operators sit on some of the most intimate data that exists: where you go, who you talk to, when. A single mishandled reuse of location data can trigger both regulatory action and customer churncustomer churnChurn rate is the percentage of customers or revenue lost over a period. It measures how fast a business loses its existing customer base.View full definition →.
Good governance also unlocks revenue. The operator that can prove its mobility insights product is properly consented and truly anonymized can sell it. The one that cannot has to shut it down.