The investigation was conducted by L’Echo, Le Monde, German public broadcasters (BR / ARD), Netzpolitik.org and BNR nieuwsradio.
Journalists posed undercover as employees at a marketing company, and were able to obtain hundreds of millions of location data points from phones in Belgium through data brokers.
Data brokers collect and sell aggregated databases of personal information, often gathered from mobile apps or online web trackers. The data is bundled and resold to advertisers, or even law enforcement and governments.
Location data is supposed to be anonymous, but it can be used to paint a picture of someone’s daily movements, and combining a few anonymous data points together can lead to re-identifying a person.
Investigating publications were able to use the data to figure out surnames, first names and lifestyle habits of at least five people who work or have worked for the EU, three of whom “hold positions of high responsibility.”
Two confirmed that the data collected corresponded to their home, workplace and travel.