Public Wi-Fi is increasingly appreciated as a socially beneficial infrastructure service. Beyond the networks being installed by cities and transport networks, and the router-sharing systems operated by BT and currently being trialled by Virgin Media, hotspots provided on retail and public sector premises across the country keep people connected through their day. But misunderstandings about legal obligations could be limiting the provision of hotspots and compromising users’ privacy.

When Ars looked into the tips published online for organisations wanting to offer Internet access to customers and the general public, we found the same wrong advice repeated by multiple sources—including vendors offering to help clients ensure compliance with the "rules."

According to the experts we consulted, anyone attempting to follow the recommendations could in practice be creating data protection liabilities that they’re ill-equipped to discharge. Others may be put off altogether by dire warnings about legal risks that simply don’t exist.

Note: This story deals specifically with the legality of public Wi-Fi in the UK. The rules and laws can vary wildly in other countries around the world.

Open all hours

Any organisation that has customers on the premises, from coffee shops to libraries, might want to offer free (or even paid-for) Wi-Fi as an attraction. By asking users to log in, businesses can also leverage Internet access to generate marketing data.

Technically, providing a hotspot is fairly straightforward. Most Wi-Fi routers provide for a guest network, separating your own traffic from visitors’ over the same broadband line. This helps to prevent users introducing malware or accessing your own networked computers, although Simon Edwards, founder of security testing company SE Labs, recommends adding a second router to properly firewall your internal network. It’s even better to use two separate broadband lines.

In all cases, standard WPA2 security will encrypt traffic to give users some protection from each other. Users concerned about security should also use VPN software (Edwards, along with many others in the industry, recommends F-Secure’s Freedome), but this isn’t the responsibility of the hotspot operator. We couldn’t find any case where a Wi-Fi operator had been held liable for a user being hacked.

Any of these setups can be installed with basic skills. Third-party hotspot services add bespoke software that presents a more formalised user experience. A portal page will pop up on the customer’s device to show terms and conditions and invite them to log in, typically requiring an e-mail address, which can then be used to build a customer database. Identifying unique users also opens up the possibility of targeting offers to repeat customers or inviting infrequent attenders back.

Collecting and storing personal information brings responsibilities under the Data Protection Act 1998 (DPA), soon to be updated (depending partly on the progress of Brexit) in line with the European Union’s General Data Protection Directive (GDPR). Consultant Tim Turner points out that a fundamental principle of data protection, re-emphasised in GDPR, is "the avoidance of using data when there is no good reason to do so." He explains: "If you end up with data as a consequence of providing a service that the person wants, there’s no problem as long as you use it for the expected purpose."

To collect and process personal data, though, you do need be registered with the Information Commissioner’s Office, and abide by the rather complex DPA rules. This is still your responsibility, as the "data controller," even if you’re using a third-party product to operate your hotspot—a point made in none of the blurbs we read. The situation is reversed if you simply permit a third party to operate a hotspot at your location without having access to any user data yourself, as is the case with the BT and Virgin Media sharing networks.

Collection and consent

The more data you collect, and the further its purposes diverge from what’s strictly necessary to provide a service, the more responsibilities you’ll incur. Analytics—the use of data purely for business purposes that have no effect on the user—or "subject"—shouldn’t be much of a problem, "although it depends on the extent that a person might be tracked or monitored," Turner tells Ars.

Marketing purposes, on the other hand, including collecting phone numbers or e-mail addresses in order to send users promotional messages in the future, invoke the Privacy and Electronic Communications Regulations (PECR), the same law that requires those annoying alerts about cookies. For this, says Turner, "it’s very clear that consent has to be freely given."

That means the user "cannot be obliged to accept something that isn’t a necessary part of the service, and they especially cannot be expected to accept marketing as part of something else." Again, this doesn’t seem to be clearly understood by hotspot solution vendors. "Our system ensures that when someone logs onto your Wi-Fi they are informed what data is being collected," reads a typical blurb. "This information is contained in the terms and conditions of using the Wi-Fi and no one can use the Wi-Fi without accepting the T&Cs."

Far from ensuring compliance with PECR, this is contrary to the principle of free consent: users should be able to opt out of marketing even if they choose to use the service. The problem is widespread, reckons Turner: "I see this a lot with airport Wi-Fi because of my job." Some locations correctly offer a marketing opt-in, while others make opting in a compulsory field, so the portal won’t give access unless the box is ticked.

Because of these issues, good advice for anyone planning to set up a hotspot would be to collect as little personal data from users as possible, and to think of any additional collection as a potential liability. Yet, again and again, we found the opposite stated: that the law required user data to be recorded and retained. It’s a persistent and surprisingly widespread myth that has its roots in misinterpretations of the last decade of EU and UK legislation; a legal grey area that’s on the point of being removed; and a single famous lawsuit that no lawyer ever seems to have heard of.

Listing image by 20th Century Fox