Governing rich telecom data under GDPR, ePrivacy, and lawful intercept

# Governing rich telecom data under GDPR, ePrivacy, and lawful intercept

At 9:14 on a Tuesday, three requests land on the same telecom operator's desk. Marketing wants to sell aggregated foot-traffic insights from subscriber location data. The national data retention rules say certain records must be kept for law enforcement. And a court has just issued a lawful intercept order for a specific customer's live communications.

All three touch the same underlying data. All three are governed by different, sometimes conflicting rules. Your job is to build a governance framework that keeps the business legal, the regulator satisfied, and the customer's rights intact.

This lesson walks through that reconciliation.

The three data regimes you must satisfy

Telecom operators sit under a denser regulatory stack than most industries. Three regimes matter here.

GDPR (General Data Protection Regulation). The EU's baseline privacy law. It applies to any "personal data," meaning information relating to an identifiable person. It requires a lawful basis for every use, purpose limitation (you use data only for the purpose you collected it for), and data minimization.

ePrivacy Directive. A telecom-specific layer that sits on top of GDPR. It governs "traffic data" (who called whom, when, for how long) and "location data" (where a device is). The key rule: these are more sensitive than ordinary personal data and generally must be erased or anonymized once no longer needed for the call, unless a specific exception applies.

Lawful intercept and data retention obligations. National laws that require operators to keep certain metadatametadataDonnées sur les données, informations décrivant le contexte, la structure, la provenance et les caractéristiques d'un asset de données (auteur, date, format, source, définition). and to provide live interception capability to law enforcement under proper legal authority. In the EU these vary by member state, partly because the Court of Justice has repeatedly limited blanket retention.

The tension is structural. GDPR and ePrivacy push toward deleting and minimizing. Retention and intercept laws push toward keeping and disclosing. Governance is how you hold both.

Request 1: Marketing wants location data

Marketing's pitch sounds harmless: aggregate where crowds gather to sell "mobility insights" to retailers and city planners.

The problem is the starting material. Location data of an identified subscriber is protected under ePrivacy. You cannot simply repurpose it because it is convenient.

Your governance options, in order of safety:

Consent. Under ePrivacy, using location data for a value-added service generally requires the subscriber's prior, informed, freely given consent, with the ability to withdraw. Consent buried in a 40-page terms document does not qualify.

Anonymization. If you transform the data so no individual can be re-identified, even by combining datasets, it falls outside GDPR entirely. This is genuinely hard. Location traces are notoriously easy to re-identify because a person's home-plus-work pattern is nearly unique.

The practical test: does your "anonymized" output survive a re-identification attempt?

# Sanity check before releasing "aggregated" location data.
# Suppress any grid cell / time bin with too few distinct users.

K_THRESHOLD = 20  # min distinct users per aggregate

def is_safe_to_release(cell_counts):
    # cell_counts: {(grid_id, hour): distinct_user_count}
    return all(count >= K_THRESHOLD
               for count in cell_counts.values())

# If any cell has fewer than K users, that row is
# too identifying. Suppress it, don't ship it.

This is a crude form of kkThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.Voir la définition complète →-anonymity: never release an aggregate that describes fewer than KKThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.Voir la définition complète → people. It is a floor, not a guarantee, but it stops the most obvious leaks.

Governance decision: marketing gets aggregated, suppressed, non-identifying data, produced through a documented pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.Voir la définition complète →, with a data protection impact assessment on file. They do not get raw traces.

Request 2: The regulator demands retention

Now the opposite pressure. National law requires you to retain certain subscriber and traffic metadatametadataDonnées sur les données, informations décrivant le contexte, la structure, la provenance et les caractéristiques d'un asset de données (auteur, date, format, source, définition). so it is available if law enforcement later needs it.

Here is the nuance many operators miss. The Court of Justice of the European Union has repeatedly ruled that general, indiscriminate retention of all traffic and location data is not permitted in most circumstances. Targeted retention, retention limited to serious crime, and expedited "quick freeze" of specific data are more defensible.

You can read the Commission's overview of the ePrivacy framework on the European Commission ePrivacy page.

So retention governance is not "keep everything forever." It is:

• Retain only the specific data categories the law names.
• Retain for the specified period, then delete automatically.
• Keep retained data logically separated from commercial data, so marketing can never touch it.
• Log every access.

The separation point is critical. The data you keep for law enforcement is not a resource the business gets to reuse. Purpose limitation means retention-purpose data stays walled off.

Request 3: The lawful intercept order

The court order is the sharpest instrument. It authorizes real-time interception of a named target's communications.

Lawful intercept is not a loophole in GDPR. GDPR explicitly steps aside for processing required by law enforcement under proper legal authority. But "proper" is doing heavy lifting.

Your governance controls:

Validate the order. Is it from a competent authority? Is it in the correct legal form? Does it name a specific target and scope? An operator that hands over data on a vague or improper request is itself liable.

Scope tightly. Intercept the named target only, for the authorized period, for the authorized data types. No fishing.

Standardized handover. Operators implement lawful intercept through defined technical interfaces (ETSI, the European Telecommunications Standards Institute, publishes the widely used standards). This keeps interception auditable and separate from normal network operations.

Separation of duties. A small, vetted lawful-intercept team handles these requests. Marketing, analytics, and general engineering never see them. This protects both the investigation and the operator.

Designing the unifying governance framework

Three requests, one dataset, one framework. The framework rests on five pillars.

1. Purpose registry

Every dataset has registered, approved purposes. Location data may be tagged "network operation," "consented value-added service," and "legally mandated retention." A purpose not on the list cannot happen. Marketing's insights product must register a purpose and pass review before it exists.

2. Lawful basis mapping

For each purpose, document the legal basis. Consent for marketing analytics. Legal obligation for retention. Legal obligation plus proper court authority for intercept. If you cannot name the basis, you cannot process.

3. Segregation and access control

Physically or logically separate the three data pools:

• Commercial pool: consented, minimized, often aggregated.
• Retention pool: locked, delete-on-schedule, no business access.
• Intercept pool: restricted to the vetted team, per-order.

Role-based access ensures no single team spans all three.

4. Retention and deletion automation

Deletion is not a policy document, it is a cron job. Each data category carries a retention clock. When it expires, the data is deleted or anonymized automatically, with the deletion logged. Manual deletion always drifts.

5. Auditability

Every access to sensitive pools is logged: who, what, when, under what basis, under what order. When a regulator or a customer exercising GDPR rights asks "who touched my data," you can answer.

Handling the collisions

Frameworks are tested at the edges. Three common collisions:

Marketing wants the retention data. No. Retention data has a single legal purpose. Purpose limitation forbids reuse. The framework's segregation makes this technically impossible, not just discouraged.

A customer files a GDPR erasure request while under a retention obligation. The erasure right is not absolute. Data you are legally required to retain is exempt from deletion. But you delete everything outside that legal minimum, and you document why the rest stays. You do not use "we might need it" as cover.

An intercept target files a data subject access request. GDPR allows restricting a subject's access when disclosure would prejudice an active investigation. The lawful-intercept regime and national law govern here. Your framework routes such requests to legal, not to the standard automated response.

The pattern across all three: the framework decides, not the loudest stakeholder.

Why this matters commercially

This is not only compliance hygiene. Regulators can impose significant fines under GDPR, and telecom regulators have their own sanction powers. Beyond fines, trust is a telecom asset. Operators sit on some of the most intimate data that exists: where you go, who you talk to, when. A single mishandled reuse of location data can trigger both regulatory action and customer churncustomer churnChurn rate is the percentage of customers or revenue lost over a period. It measures how fast a business loses its existing customer base.Voir la définition complète →.