Purpose, people and data flows
Re-identification is the process of linking supposedly anonymous data back to a specific individual. In proximity technology and indoor location systems, this risk arises because location data is rarely as anonymous as it first appears. A dataset containing only device identifiers, timestamps and signal strength readings may look stripped of personal details, but the patterns within that data can often reveal who the person is.
The core problem is that human movement is distinctive. A device that appears at the same residential postcode between 23:00 and 07:00, visits a specific office building on weekdays and attends a particular school gate at 15:30 on Tuesdays can be distinguished from every other device in the dataset without any name, email address or phone number being present. Researchers have repeatedly demonstrated that even coarse-grained location data—such as mobile mast logs—can uniquely identify a large proportion of individuals in a sample.
Under the UK GDPR, personal data is defined by whether a person can be identified, directly or indirectly. If location data can be linked to an individual through reasonable means, it is personal data regardless of whether a name is attached. The Information Commissioner's Office (ICO) has made clear that pseudonymisation—replacing a name with a code—does not remove data from the scope of UK GDPR if re-identification remains feasible.
In practice, re-identification in proximity systems tends to follow a small number of paths. The most straightforward is linkage with another dataset held by the same organisation: a retailer that matches a beacon device identifier against a loyalty card lookup at the till, or a venue that ties a Wi-Fi MAC address to a ticketing record. A second path involves inference from the data itself, as in the home-and-work example above. A third arises when data is shared with or sold to third parties who possess their own datasets capable of bridging the gap.
Consent, lawful basis and user choice
Retail environments
A common retail deployment uses beacons or Wi-Fi observers to measure footfall, dwell time and zone transitions. If the same system also captures a device identifier at a point-of-sale terminal—through a companion app, a Wi-Fi sign-in or a loyalty integration—the movement history for that identifier becomes linked to a known customer. Even without an explicit link at the till, a retailer that holds home delivery addresses for a subset of customers may be able to match those addresses to the overnight location patterns in its beacon data.
The practical question for retail operators is not whether re-identification is theoretically possible, but whether the data architecture makes it easy or difficult. Systems that store raw device identifiers alongside transaction records in a single queryable environment present a higher risk than architectures where location aggregates and customer records are kept in separate systems with controlled access.
Museums and cultural venues
Museums often deploy beacons or NFC to trigger exhibit content and measure gallery flow. Ticketing systems typically capture visitor names, postcodes and sometimes email addresses. If the venue's analytics platform correlates a device identifier observed near exhibits with a ticket scanned at entry, the full movement path of that visitor becomes attributable. For venues that publish visitor research or share data with funders, the risk is that what appears to be anonymised footfall data could be reverse-engineered if the recipient also holds ticketing information from a shared event.
Events and conferences
Event organisers frequently combine badge-scan data with indoor positioning to produce heatmaps and session attendance figures. A delegate's badge record usually includes name, employer and job title. If the indoor positioning system logs the same device identifier that the badge system records at a check-in point, the two datasets are effectively joined. The risk intensifies when event data is passed to sponsors or exhibitors: a sponsor receiving "anonymised" zone visits may be able to match those visits against their own lead-capture scans from the same event.
Third-party data sharing
Some proximity platforms offer aggregated analytics or data-sharing arrangements with advertisers. The re-identification risk here depends on the granularity of what is shared. A daily count of visitors per zone presents minimal risk. A feed of hashed device identifiers with timestamps and zone labels, even without names, may allow a recipient who holds other location datasets to perform a linkage attack. When evaluating platform contracts, the key detail is not whether the data is called "anonymised" but what fields are actually transmitted and whether any unique or quasi-unique identifiers remain.
Exceptions, incidents and reassessment
Assuming pseudonymisation equals anonymisation
The most frequent error is treating a randomised device ID or a hashed MAC address as genuinely anonymous. Pseudonymisation is a useful safeguard, but under UK GDPR it does not change the status of the data. If the pseudonymised identifier can be linked back to an individual—through another dataset, through inference or through a simple lookup—the data remains personal data and must be handled accordingly.
Ignoring cross-dataset linkage
Organisations often assess the re-identification risk of a single dataset in isolation. A beacon log looks harmless. A ticketing list looks standard. The risk emerges at the point where those datasets meet. A data protection impact assessment (DPIA) that does not map the actual data flows between systems—point-of-sale, CRM, ticketing, Wi-Fi captive portal, beacon analytics—will underestimate the risk.
Insufficient aggregation before use or sharing
Sharing or publishing data at too fine a granularity is a common pitfall. Zone-level dwell times broken down by 15-minute intervals can be distinctive enough to single out an individual, especially in venues with lower footfall. Effective aggregation means choosing bin sizes and minimum thresholds that make individual extraction impractical. There is no universal threshold that guarantees anonymity; it depends on the venue size, visitor numbers and the diversity of movement patterns. The ICO's anonymisation code of practice advises testing whether individuals can still be singled out after aggregation is applied, rather than assuming a fixed rule.
Overlooking staff and contractor data
Location systems in workplaces, warehouses and venues also capture the movements of staff and contractors. A device that appears in a back-office area every weekday at 08:55 and leaves at 17:05 is readily identifiable to anyone with access to the staff rota. If location analytics are shared with a third party without filtering or aggregating staff device identifiers, that third party may be able to infer staffing patterns, shift times and individual attendance.
Key checks to apply
- Map every system that captures or stores device identifiers. Include beacons, Wi-Fi observers, NFC readers, QR scan logs, apps and any integrator platforms that cache data locally or in the cloud.
- Identify all points where datasets are joined. Look for API calls, shared databases, ETL processes and manual exports that bring location identifiers together with names, ticket records or transaction data.
- Review what is shared externally. For each data export or API feed to a sponsor, landlord, platform vendor or funder, list the exact fields included and assess whether any quasi-unique identifiers remain.
- Test aggregation assumptions. If you rely on minimum visitor counts or time-bin sizes to prevent singling out, verify with a sample of your actual data whether individuals can still be distinguished.
- Check supplier contracts. Confirm whether your proximity platform vendor retains raw identifiers on their servers, processes data outside the UK or EEA, or has the right to use aggregated data for their own purposes.
- Document the re-identification risk in your DPIA. A DPIA that acknowledges the risk and sets out the mitigations—separation of datasets, aggregation thresholds, access controls, contractual restrictions on third-party use—is stronger than one that asserts the data is anonymous without evidence.
Re-identification is not a theoretical edge case. It is a structural property of location data that becomes more acute as datasets are combined. For any organisation operating beacons, NFC, QR or indoor positioning in the UK, treating location data as personal data unless proven otherwise is the safer operational starting point, and one that aligns with the ICO's current guidance.
