The data protection law exists for the protection of personal data, defined as "data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller"[1]

If the airport authority is not gathering any other information beyond the device MAC address, and is not connecting that information to other information sources (such as MAC addresses gathered from WiFi registrations) then the MAC address cannot be used to identify a living individual.

Now, we all know that there is a correspondence between such a MAC address and a single individual, just as there is with DNA or fingerprints or footfall pattern or voice analysis or facial recognition, or car registration numbers or any of a number of other identifying characteristics. However, the law does not concern the gathering of data (however unique), merely the gathering of personal data that identifies someone in conjunction with other data in the possession of the data controller.

Just because that data could be used to identify someone (in a different system) does not mean that it is covered under data protection obligations in this system.

[1] https://www.dataprotection.ie/docs/What-is-Personal-Data-/21...

That is to say that, while possible, such a mapping is by no means easy or automatic, and it would have to be very calculated and deliberate and even then couldn't be 100% accurate without a whole lot of engineering. In such a case of deliberate and specific design to gather and associate MACs and identities, then yes, the law applies to such a conjunction.

You don’t have to work on a static set of MAC addresses and individuals, rather, you can dynamically track arrivals and departures from your crowd of individuals. So instead of hundreds of people being more or less stationary you get movement data on the few new members of the set and on those who left, including whereto or wherefrom they moved.

After tracking not just one crowd but five, it should be possible to map out trajectories for both faces and MAC addresses. The larger the area or surveillance per traveller and differences in e.g. movement speed, the stronger the useful correlation between these trajectories should be.

If I was really serious about it, I'd tie detection timing to the visual signals on the xray machines that tell security agents whether or not you can pass and whether to perform a secondary check.

http://blog.higg.so/2015/11/03/look-at-my-invention/

> I just want to bust open the false narratives surrounding phone culture and speak about the long term implications of having a computer in your pocket at all times that talks to the public Internet.

It's as if the article was designed for the likes of what I wrote in my article. The Big Brother narrative is a false narrative.

> Big Brother gets the brunt of the blame, and not the citizen. In the worst case, the citizen identifies with the aggressor and feeds the narrative: "I am not in control, Big Brother is. I willingly submit my data to third parties". But, you are in control, and you should never forget that. Perhaps you need to work hard at being in control, or challenge more assumptions about that, but in a free and democratic society, we are in control (and empowered) more than we have ever been.

Regardless of its uniqueness, it can't be used by that data controller to identify you because the collector does not have additional information.

I can't identify you by reading your car licence plate, even though that information can be used to identify you by others who have access to a database of cars-to-owners. The point of the law is that I can't use it to identify you, therefore I don't have to notify you when I collect that information.

Is? Or was?

Was the law written when mass tracking of inidivuals by unique serial numbers was common, possible, or feasible?

But I wouldn't be worried about just MAC tracking, you get far better and accurate information by tracking probe requests. Just by capturing probe requests you can at times guess where the target lives, works and even where they spend their free time.

People need to take responsibility for themselves. If you have a problem with this, TURN YOUR WI-FI OFF.

Suggesting that people "need to take responsibility for themselves" is tantamount to victim blaming when it comes to broadcasting identities for gathering by third parties. The responsibility for correctly using data should really lie with those that collect the data, and that's what data protection acts in Europe tend to target.

[1] http://www.livescience.com/5188-odor-unique-fingerprint.html

[2] http://www.wired.com/2011/09/walking-biometric-identificatio...

[3] https://en.wikipedia.org/wiki/Speaker_recognition

And to be clear, this in no way implies that I am okay with this state of affairs.

(Would it be a privacy problem if MAC adresses were very short-lived? I really don't know.)

And sniffing for probe requests is way more revealing than just sniffing MAC addresses. Only real solution is to turn off all WiFi and bluetooth devices, latter is getting harder and harder with smart watches, wireless headphones and other stuff.

That being said I'm not worried about being tracked while I move through an airport, since they already have cameras. Also your ticket is pretty telling, they know when it gets printed out, when it gets scanned in security and when it's scanned in the boarding, so you have always been tracked. This just brings more accurate data how long it takes for you to get from point A to B.