4 ms·

I am wondering if this is also happening in the EU or with customers from the European Union. The provider would probably put something to the effect of "we can

I am wondering if this is also happening in the EU or with customers from the European Union. The provider would probably put something to the effect of "we can do what we want" into their fine print. But I am not sure if this is legally clear cut under the regulations of the GDPR.

p_l 5y ago
> I am wondering if this is also happening in the EU or with customers from the European Union. The provider would probably put something to the effect of "we can do what we want" into their fine print. > But I am not sure if this is legally clear cut under the regulations of the GDPR. > I am wondering if this is also happening in the EU or with customers from the European Union. The provider would probably put something to the effect of "we can do what we want" into their fine print. > But I am not sure if this is legally clear cut under the regulations of the GDPR. Those messages are part of the original reason for SMS existence, and yes all networks use them - both remotely triggered and unsolicited like in the article. They are vital to operation of the network. Allowing end users to message over this channel was a relatively late addition to the spec. Effectively, for many good reasons, the demarcation point between your part of the device and provider part is the interface between application processor (what runs Android/iOS etc) and the baseband processor which handles the stuff you need a license for, with the licensed party being effectively the provider. When it comes to GDPR, what actually happens is that the providers can't escape handling PII anyway, as it is crucial for their operation. Usually it means that there are some heavy safeties on access to PII, both practical and legal, but operations crew has a lot of capability and thus responsibility. Main difference seems to be that in EU, the carriers can't get away with as much monetization of this as they can in USA.
lxgr 5y ago
The mechanism described does not give any information to the network that it doesn't already have: The IMEISV is part of the regular network sign-on procedure. This is probably just an optimization so that they don't have to keep track of changing IMEISV/IMSI-pairs in their database, for whatever they do with that. In fact, it might be even more GDPR-respecting than the database alternative: If the purpose is to trigger some updates that should happen with every phone switch, it removes the need to track this data server-side. Realistically, it will be stored anyway, as mandated by many countries' data retention laws.

p_l 5y ago

> I am wondering if this is also happening in the EU or with customers from the European Union. The provider would probably put something to the effect of "we can do what we want" into their fine print. > But I am not sure if this is legally clear cut under the regulations of the GDPR. > I am wondering if this is also happening in the EU or with customers from the European Union. The provider would probably put something to the effect of "we can do what we want" into their fine print. > But I am not sure if this is legally clear cut under the regulations of the GDPR. Those messages are part of the original reason for SMS existence, and yes all networks use them - both remotely triggered and unsolicited like in the article. They are vital to operation of the network. Allowing end users to message over this channel was a relatively late addition to the spec. Effectively, for many good reasons, the demarcation point between your part of the device and provider part is the interface between application processor (what runs Android/iOS etc) and the baseband processor which handles the stuff you need a license for, with the licensed party being effectively the provider. When it comes to GDPR, what actually happens is that the providers can't escape handling PII anyway, as it is crucial for their operation. Usually it means that there are some heavy safeties on access to PII, both practical and legal, but operations crew has a lot of capability and thus responsibility. Main difference seems to be that in EU, the carriers can't get away with as much monetization of this as they can in USA.

lxgr 5y ago

The mechanism described does not give any information to the network that it doesn't already have: The IMEISV is part of the regular network sign-on procedure. This is probably just an optimization so that they don't have to keep track of changing IMEISV/IMSI-pairs in their database, for whatever they do with that. In fact, it might be even more GDPR-respecting than the database alternative: If the purpose is to trigger some updates that should happen with every phone switch, it removes the need to track this data server-side. Realistically, it will be stored anyway, as mandated by many countries' data retention laws.