Is personal data processing in wireless access points based on the data subject's consent?

ANSWER

For wireless access points to the Internet provided by a municipal authority, personal data processing may be based on Article 6(1)(e) GDPR — processing is necessary for the performance of a task carried out in the public interest — or alternatively on Article 6(1)(b) GDPR — processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the data subject's request prior to entering into a contract. In this context, a contract should be understood as the terms of use of such a wireless access point, which should be available at the data controller's premises and, for example, on its website.

In addition to the terms of use, it is necessary to provide the privacy notice under Article 13 GDPR, for example on a notice board, so that anyone using the access point can read it. There will therefore be no need to base this type of personal data processing on consent under Article 6(1)(a) GDPR.