Recently, the Dutch Data Protection Authority (Dutch DPA) found that TP Vision, a Philips smart TV manufacturer, violated the law by collecting and storing users’ personal data via smart TVs without duly notifying them.

TP Vision uses cookies (Google Analytics) to collect data concerning users’ online viewing behaviour. Examples of such behaviour are when the viewer watches television, what his/her favourite TV programmes and apps are, which TV programmes the user records, which on-demand videos he/ she pays to watch, and which “missed programmes” the user watches after they have been broadcast. Based on the data collected, TP Vision knows what the viewer is interested in, and it then issues personalized viewer suggestions via the smart TV. TP Vision also wants to use the collected data so that it can personalize advertisements to its viewers. The Dutch DPA found these types of collected information to be personal data.

According to the Dutch DPA, it is important that people have control over their own personal data, so they should be informed about TP Vision’s collecting of data concerning their viewing behaviour and about what happens to their data. TP Vision violated the law not only by the fact that viewers were unaware of their viewing behaviour data being collected, but also by not obtaining the viewer’s legally valid consent for such data collection.

During the case’s investigation, TP Vision made several changes to its data collection operations. For example, it added a privacy statement and a cookie policy to its terms of use. However, the Dutch DPA is of the opinion that the information given still does not comply with the law. In addition to its amended terms of use, TP Vision also implemented a policy on seeking users’ consent regarding its usage of cookies. Unfortunately, despite these changes and policies, TP Vision failed again because it provided no complete and clear information on data collection and therefore any obtained consents may not be legally valid. Also, TP Vision does not seek users’ consent to place advertisement cookies and cookies that record app usage and website visits on their smart TVs. Finally, TP Vision was ordered by the Dutch DPA to conclude a data processor agreement with Google so that Google can process via Google Analytics the personal data that TP Vision collected; this would ensure that the data are properly protected and will not be used by Google for its own purposes. The latter obligation should cease, however, because TP Vision indicated that it will in due time launch its own analytics system and will therefore end its cooperation with Google.

The Dutch DPA has announced that it will continue to take enforcement actions if TP Vision continues to violate the law.

Source: http://www.cbpweb.nl/Pages/pb_20130822- persoonsgegevens-smart-tv.aspx