Skip to main content
Praxikon

Ruling

Council of State: 600,000 euro fine for wifi tracking in Enschede stays annulled

Date
Status
final
Body
Raad van State, Afdeling bestuursrechtspraak
Reference
ECLI:NL:RVS:2026:4403, zaaknummer 202401622/1/A3
Amount
€600,000

What it is about

From 25 May 2018 to 30 April 2020 the municipality of Enschede counted city centre visitors with at least ten sensors capturing (pseudonymised) phone MAC addresses. On 11 March 2021 the DPA fined it 600,000 euros for processing personal data without a legal basis. On 2 February 2024 the Overijssel District Court annulled the fine because the DPA had not proven the data were personal data. On appeal the DPA conceded that the three identification routes in its decision did not meet the standard of proof. Its new position, that people were directly identified by counting unique visitors, had not been taken in the decision. The Council of State disregards it: the decisive evidence must be provided at the decision stage. The DPA's appeal is unfounded.

What this means in practice

The DPA must fully prove at the decision stage that personal data and a breach are involved; evidence or new reasoning first raised in court does not count. This is no licence for wifi tracking: the court did not say MAC addresses are not personal data and did not assess on the merits the position on direct identification through unique counts. Anyone deploying sensors must still justify necessity, legal basis and anonymisation.

The GDPR articles concerned

Source: Rechtspraak.nlchecked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

The counterpart in the other law

Case law8 of 14

Guidelines8 of 13

Enforcement and fines8 of 11

Legislation in motion6 of 10