Welcome to Creativity Software -  Location Based Services & Solutions
Creativity Software provides LBS solutions.

Industry Code of Practice for the use of mobile phone technology to provide passive location services in the UK
(24 September 2004)

TABLE OF CONTENTS

1. INTRODUCTION
2. GENERAL PRINCIPLES
3. SPECIFIC PROVISIONS
A. Code of Practice for child location services
B. Code of Practice for friend location services
C. Code of practice for mobile games (and similar services) supported by location services
D. Code of Practice for corporate location services
ANNEX A - Glossary
ANNEX B - Obtaining consent (for child location and friend location services)
ANNEX C - Random alerts for child location services
ANNEX D - Random alerts for friend location services
ANNEX E - Stopping, suspending service
ANNEX F - Location services and you
ANNEX G - Extract from SI on Privacy and data protection
ANNEX H - Working Group participants

1. Introduction
It is expected that many location services using mobile phone technology will be launched into the market and that the benefits to consumers will be substantial.
The purpose of this Code of Practice is to set principles of good practice for the provision of such services. They have been developed by a working group comprising of nine leading location service providers (“LSP”) in the UK and the five mobile network operators. A list of participants can be found in Annex H.
The working group will subject the Code of Practice to regular review, so that it remains relevant to the needs of customers and industry and compliant with applicable law. All LSPs using location data supplied by mobile network operators in the UK should, at minimum, observe this Code of Practice.
Location services may be either 'active' or 'passive'. ‘Active’ location services are those that are initiated directly by the mobile phone user. An example of such a service is “Where’s my nearest chemist/cash machine/cinema etc.?”
A response from the LSP would typically supply this information to the customer in the form of an address, a map or directions, based on the customer's location. The working group does not believe that there are significant safety issues associated with such ‘active’ location services.
This Code of Practice focuses on ‘passive’ location services, which are defined as those services where a mobile phone user, once s/he has enabled the service, consents to be located by another, when that other person initiates a location request (either from another mobile phone or from a PC). They do not relate to the day to day operation of a mobile network, where location data is used to pass incoming calls to customers or used by the emergency services to allocate 999 calls to the correct local emergency service.
Industry and the public alike do not want location services to be used to locate customers, particularly children, either without their knowledge or against their will. As with everything, risk cannot be completely eliminated and so the Code of Practice seeks to balance usability with safeguards in a proportionate and reasonable manner. For the purposes of developing the Code of Practice, services are broken down into four main types:
A. Child location services
B. Friend location services
C. Mobile games supported by location services
D. Corporate location services
Annex F includes a section “Location services and you” which provides information on the Code of Practice and additional safety messages which will be used for awareness raising by LSPs supporting this Code of Practice, for example on web-sites explaining the use of location services.


2. General principles
This Code of Practice is designed to provide consumer (particularly child) protection measures that supplement the legal and regulatory requirements such as privacy and data protection legislation (including Regulation 14 of the Privacy and Electronic Communications regulations 2003 – Restrictions on the processing of location data, which is laid out in Annex G).
The Code of Practice does not constitute legal advice nor does it seek to interpret privacy and data protection legislation, which applies to both active and passive location services. LSPs should seek their own advice regarding the application of the law to their service.

The Code of Practice is underpinned by some general principles:

- Location services must be consent-based and simple for consumers to understand and use with confidence
- Where practical, in the interests of simplicity, recommended industry standard text should be used for obtaining consents, sending alerts and stopping or suspending services
- Location services should not be used to undermine customer privacy and, in particular, should not be used for any form of unauthorised surveillance
- Alert messages should be sent at random to guard against consumers being located without their knowledge
- Location services should be easy to stop or temporarily suspend
- Advice on how to use location services and key safety messages should be readily at hand
Advice to consumers
LSPs should make available information on their web sites (which should also be accessible via WAP) and through other material on how their location services operate. This should include the standard text of “Location services and you” which has been agreed by the industry - see Annex F.
Advice to consumers should encompass at least:
• service terms and conditions;
• conformity with data protection legislation;
• how to contact the location service provider's customer service, including by telephone;
• how locatees can access information about who can locate them;
• key safety messages, including instructions on how to stop or suspend any location service offered; and
• The LSP’s approach to the disclosure of location data when a locatee’s handset is switched off.


3. Specific provisions
A. Code of Practice for child location services
This Code of Practice lays out the procedures that should be followed by providers of passive location services which can be used for locating children. These services are typically configured in a way that allows the mobile phone or other device used by the child (the locatee) to send its location to the mobile phone or PC used by the parent/carer (the locator), either at regular intervals or at the request of the locator.

1. Identity Verification
It is fundamental to this Code that parents are confident that child location services are not readily open to abuse. To that end the Code targets identity verification as requiring sequential ‘layers’ of validation and safeguards as a proportionate response to risks.
The following procedures are based upon the reasonable endeavours of what can be achieved now – i.e based on public databases that are currently available to commercial companies – and the existing arrangements are being kept under review. At the same time the process recognises that registration for location services could utilise the Internet as well as visits to retailers, and that both electronic and other forms of payment will be possible.
The three primary aspects of the Codes relate to:
- The identity of the locator (normally parent or guardian)
- The relationship between the locator and the locatee (normally a child)
- Dealing with consent of the locatee before location information is revealed

2. Identity of the locator
Location Service Providers will seek to establish and then to verify the name, address and, if applicable, mobile telephone number of an applicant before the ability to locate another mobile telephone is activated. The following data sources will be used:
• External - reputable agencies (such as Dun & Bradstreet; Experian or Equifax) that use a broad range or data sources to carry out either identity checks or credit checks OR using a credit card clearing house that uses name and address information to validate a transaction OR the provision of two original (ie not photocopies) official documents that are less than 4 months old (such as a utility bill, bank statement, council tax bill, TV licence or driving licence) containing the name and address of the applicant.
- Internal – existing customer, equally robust, data held by the location service provider on the applicant.
As an additional precaution applicants will be encouraged to use a credit card at the point of registration as in some cases this may permit further validation.

When applicants are registered through a web site, an e-mail address must be captured. Following registration, an e-mail validation code (or web based link) must be sent to the e-mail address and the user must respond to the code in a pre-determined way confirming the e-mail address before location requests can be made on the account. (This is in addition to the PIN sent to the postal address, as per next paragraph).
Following satisfactory checks, a unique PIN confirmation will be sent to the locator’s postal address in the United Kingdom. For this purpose a foreign address, PO Box numbers or other known accommodation addresses will be excluded.
Location services will not commence until PIN code has been returned. A full audit trail will be kept of those registered; the methods used to validate identity and the name/mobile telephone number of the person who the locator is approved to seek to locate.

3. Relationship between the locator and the locatee
The LSP must ask the locator to confirm the date of birth of a locatee. If a child under the age of 16 is to be located, the first locator opening an account with an LSP must be the child’s parent or legal guardian.
The locator must make a declaration of his or her specific relationship to the child being located.
To facilitate family use of location services it is permissible for a parent or legal guardian to act as a master locator, register for a service and then add other handsets or devices belonging to additional locators.1
If the prospective locator gives the location service provider any reason to doubt the relationship claimed, then documentary evidence may be required to resolve the uncertainty.

4. Consent of the locatee
There are some practical difficulties in establishing whether young children have the ability fully to understand the implications of consenting to their location being passed to others.
As a first safeguard, therefore, if the locatee is under 16, the parent or guardian must give consent to the child signing up to the location service. In addition, the child should also consent. If the child does not consent, his or her wishes must not be overridden and the service must not be activated. In the event that the child does not have the capacity to give consent, the consent of the parent will suffice.
The request for consent must follow the text shown at Annex B and only be accepted when identified as being sent from the l device that is to be located. Further, such a message must include a previously issued activation code (or some similarly secure technique) known only to the locatee. If consent is refused or fails to comply with the method of confirmation, then the service will not be activated even if requested by a parent.

1 The master locator’s account must be protected by a username or customer number and a secret password so that unauthorised handsets cannot be added without the master account holder giving consent.
Explanatory literature must make it clear that the master locator assumes responsibility for management of the account, including the activities of the other locators.

5. Information to locatee
The next safeguards apply once registration has been completed. First, locatees can request from the location service provider, a list of all names and telephone numbers of persons authorised to track their mobile telephone via the service.

6. Random alerts to locatee
Second, the locatee must receive random SMS alerts to remind them that their mobile telephone is registered so that others can identify their location. The text and frequency of such messages is shown at Annex C. If an alert is not delivered for whatever reason, it will continue to be sent until delivered. Alerts should be sent at random intervals, not in a set pattern.

7. Marketing and promotion of child location services
a) Child Location Services should not be marketed in any way which exploits parents' concern or fear that their child may become a victim of crime.
b) Child location services should be marketed appropriately, taking account of the fact that knowing where the child's phone is does not necessarily tell you of the location of the child or that he or she is safe.
In order to guard against unwarranted claims being made in the promotion of these services, all printed and on-line marketing collateral associated with the product should include the following standard statement agreed by industry :
"Location Services are designed to locate the phone of another person. For the service to work, the phone has to be switched on and within network coverage. Location services aimed at children are intended to complement, not be a substitute for, normal parental supervision. They give information about the location of a child's phone and, in conjunction with other types of communication, such as phoning or texting, can help parents keep in touch with their children"

8. Stopping or suspending the service
Finally, a simple way to stop a location service, either temporarily or permanently or to remove one or more of the registered locators is set out at Annex E.


B. Code of Practice for friend location services
This guideline lays out the principles of good practice that should be followed by providers of passive location services supplied for the purpose of locating friends. These services are typically configured in a way that allows the mobile phones of friends to locate each other on a reciprocal basis.
The objective of the Code of Practice is to lay down practical steps to combat misuse. LSPs may exceed the minimum standard of controls as they see fit.

1.1 Age Verification
Friend Location Services should only be made available to those that the LSP - or serving MNO - has verified are 16 years old or over.
LSPs must maintain a list of the evidence that is accepted as proof of age during the signing up process. The list must be provided to mobile operators on request.
The attention of the prospective locator must be drawn to any relevant terms and conditions and the prospective locator must confirm their acceptance.

1. 2. Consent
LSPs must (under Privacy and Data Protection legislation) obtain from all locatees consent to being located before any location service is activated. Recommended text is laid out in Annex B. The LSP must check that the consent is being sent from the device that is to be located. Consent should be confirmed by the return of an activation code known only to the locatee or some other mechanism, which can be demonstrated to be equally secure, to ensure that the consent is being sent from the locatee’s device and not a PC or some other mobile device.
In addition customers must be provided with clear safety advice at service commencement. This should include appropriate and unambiguous advice to locatees to consent to the operation of friend location services, only where they know the prospective locator.
As an example, the following message (or some similarly unambiguous equivalent) must be sent to the locatee as an SMS [in tandem with the request for consent]
WARNING: [SERVICE NAME] ALLOWS OTHER PEOPLE TO KNOW WHERE YOU ARE. FOR YOUR OWN SAFETY MAKE SURE THAT YOU KNOW WHO IS LOCATING YOU.
Reciprocity
Friend location services may be provided on a reciprocal basis between two individuals. Once individual A has requested and received consent to locate individual B, a reciprocal right is automatically conferred on B. The principle of reciprocity should then be maintained at all times.
If individual A withdraws consent (permanently or temporarily) to be located by individual B then by automatic default individual A may not locate individual B so that the principle of mutual location is not broken.

1.3. Random alerts to locatee
Subsequent to activation, the LSP must send periodic SMS alerts to all locatees to remind them that their mobile phone can be located by other parties. These alerts should be sent at random intervals, not in a set pattern. The suggested text and minimum standard frequency for sending the alerts is set out in Annex D
If an alert is not delivered, for whatever reason, it must be re-sent until it is delivered. Even if no location requests have been made in relation to a locatee since the previous alert was sent the alert must still be sent.

1.4. Information to locatees
Locatees should be able to receive on request from the LSP a list of all names of people authorised to track their phone via the service.

1.5. How to stop a service
There should always be a simple way to stop a location service either temporarily or permanently or to remove one or more of the registered locators. Examples of how to do this are laid out in Annex E.

1.6 Introduction services
Location Services, which are used to facilitate the introduction of customers who are not known to each, should only be made available to those that the LSP - or serving MNO - has verified are 18 years old or over.
Where an individual has given a consent to be located in advance of any request from a locator, some of whom may not have been previously known to him or her, there must be no presumption of the reciprocity of the consent.


C. Code of practice for mobile games (and similar services) supported by location services
This Code lays out the principles of good practice that should be followed by providers of mobile games (and similar services) which are integrated with passive location services.
Where games include features that could lead to strangers being introduced to each other or the location of one stranger being revealed to another these features should not made available to customers under the age of 18, unless the identity and address of all players have been verified.
The objective of the Code of Practice is to lay down practical steps to prevent misuse. LSPs may exceed the minimum standard of controls as they see fit.

1. Traceability of players
Where a game includes the following features:
- games are multi-player, and include the option of strangers pitted against each other; and
- geographical location information is used as part of the game; or
- the game allows unmoderated chat between players
The LSP must verify that all customers playing the game are 18 or over. Alternatively, and providing no unmoderated chat is offered, the LSP can offer fully fledged games to those under 18, where the address and identity of all players in a game have been verified, using the documentation approved for Child Location Services.
Location information, where provided, should only be available for the duration of the game.

2. Protection of customers under 18
Where the LSP has not verified that all players in the game are either at least 18 or has not verified the name and address of all players, the games provider must adhere to the following Code of Practice:
• Players identities/MSISDN should not be given out to other players – they should use an alias
• True physical location information which would reveal the whereabouts of players should only be obtained by games providers for the purposes of the game and should not be given out to other players;
• Games are therefore based in a virtual world or location feeds are mapped in such a way that they do not disclose the identity of players, actual location or the actual distance away that one player is from another;
• No physical safe-havens or sponsored locations are permitted within the game which would facilitate players meeting up for example Treasure Hunts;
• No linked chat facilities are permitted unless they are moderated and cannot be used to make actual contact. Such moderation may include the use of templates (i.e. a set of fixed phrases) pre-defined by the LSP.

3. How to stop a service
There should always be a way to stop a mobile game supported by a location service either temporarily or permanently. When a mobile game supported by a location service is stopped or suspended location information should no longer be provided.


D. Code of Practice for corporate location services

This Code of Practice lays out the principles of good practice that should be followed by providers of passive location services to corporates such as businesses, local authorities, charities and other organisations.
These services are typically configured in a way that allows a mobile device fixed in the corporate’s vehicle or of an employee or of an associate (the locatees) to send its location to the mobile phone or PC of the corporate customer (the locator), either at regular intervals or at the request of the locator.
Another use of a corporate location service is for marketing and promotion of goods to customers and potential customers. This topic is covered in more detail in section 4 below.
The objective of the Code of Practice is to lay down practical steps to prevent misuse. LSPs may exceed the minimum standard of controls as they see fit.

1. Traceability of bona fide corporate customers
LSPs should verify that their corporate customer is a bone fide organisation. They must verify the name and address of the corporate customer that has registered to locate mobile phones used within or in association with the organisation, before service commencement.
Examples of verification of a corporate customer may include the use of:
• company registration including registered address and proof that an organisation is trading such as evidence of employment liability insurance,
• banking or credit validation using reputable agency e.g. Dun & Bradstreet, Experian or Equifax, or
• verification of the identity and address of Directors or other responsible individuals.
Examples of verification of the identity and address of Directors or other responsible individuals may include the use of combinations of:
• copies of identity and address documentation such as that required for contract phone provision;
• other reputable identity documentation such as Citizencard;
• a valid credit card transaction at point of registration;
• a unique PIN confirmation sent to a locator’s postal address in the UK (not including a PO Box address), where the location service does not commence until the address is confirmed and / or
• Identity Validation Check using reputable agency e.g. Dun & Bradstreet, Experian or Equifax.
LSPs must maintain a list of all corporate customers including an audit trail showing the validation method used. LSPs must be able to provide proof of identity validation including the corporate customer’s name and address upon request.

2. Consent or confirmation of mobile devices within corporate control
For corporate location services, LSPs may choose to confirm individual locatee consent followed by the use of random notification mechanisms detailed within Annex D.
Where an LSP does not use this approach it must satisfy itself that all corporate customers have taken sufficient steps to obtain the necessary consents from the users of the mobile devices that are subject to the location service. LSPs must be able to provide proofs of consents upon request from a MNO.

3. The corporate customers’ responsibilities
LSPs must, through their contract terms and conditions, make it clear that it is their customer’s responsibility to use the service within the law, including all relevant privacy and data protection legislation.
The location service provider's contract must state clearly that its customer will be responsible for managing the processing of location data and distributing information to their employees or associates about the service and how it operates.
The location service provider's terms and conditions must lay down the consequences of misuse by its customer. These may include service suspension and, in cases of persistent mis-use, service withdrawal.

4. Location notification
In order to protect against the location service being used for unauthorised or accidental surveillance of individuals that are not employees or associates of the corporate customer, LSPs must send out or ensure that their customers send out a confirmation SMS or e-mail to a mobile device which is the subject of a business location service. Where there is no text or email enabled, notification to the locatee must be sent in writing to the locatee’s address.
As an example the following text may be sent to a device once a location service is enabled:
"[CORPORATE CUSTOMER’S NAME] can locate this phone at any time. Should you have any questions please contact please call [CORPORATE CUSTOMER PHONE NUMBER] or send STOP [SERVICE NAME] to [SERVICE NUMBER]. [SERVICE WEBSITE] by [PROVIDER NAME]."

5. Promotions and competitions
Companies may want to use location services for marketing campaigns and competitions. In some cases these are clearly Active services but in others, the location look up will be done at sometime after registration and therefore is a Passive service.
Examples of 'passive' uses are given below:
i) Competition advertised on wrappers/labels/posters etc. User sends a text to enter the competition and by doing this consents that their location maybe used at some defined point in the future as part of the competition. All terms and conditions will clearly state that location may be used, will provide specific details of when location information will be used and the customer’s details will only be kept for the duration of the competition.
ii) Promotion will encourage users to sign up to a specific campaign where over the period of the promotion the location may be requested several times, and they will be advised of special offers etc near where they are. They may also be encouraged to be in specific locations at certain times.
Should any such promotions or competitions facilitate more than one entrant being in the same location(s) at the same time(s), the promotion or competition should only be targeted at or be open to customers that have been verified to be 18 or over.
To avoid duplication the Industry Code of Practice refers out to section 10 of the Mobile Marketing Association’s Code of Conduct (published December 2003 at www.mmaglobal.co.uk)
10. Are there any special requirements if I am using location based mobile marketing?
The collection and use of location data relating to individuals is subject to specific legal requirements, in particular those set out in the Electronic Communications Regulations.
If you are planning to collect or use such data in any way you must make sure that you comply with these requirements.
In addition, you must:
• only send location based mobile marketing (i.e. mobile marketing which is sent based on the location of the recipient at a given time) to people who have specifically agreed to receive this type of marketing; and
• each time you send a location based mobile marketing communication provide the recipient with a simple free of charge (other than the costs of transmission) means of opting out of receiving any further such location based mobile marketing communications at any time.
When asking people to opt in to receive location based mobile marketing you must make clear to them:
• that in order to send them such marketing it will be necessary to identify the location of their mobile device and so their personal location; and
• what you will be using these location details for.


ANNEX A - Glossary
Associates: An individual that is contracted to work for a corporate customer, such as an agency temp or sub-contractor.
Locatee: The person being located in a passive location service.
Locator: The person initiating a location request in a passive location service.
Location services: services that are supplied to mobile phone users, drawing on the location information derived from mobile phone networks.
Location service provider (“LSP”): A value added service provider who offers a service using location information provided by a mobile phone network or through the use of a satellite positioning system.
Mobile network operator: The five network operators in the UK are O2, Orange, T-Mobile, Vodafone and 3.
Passive location services: those services where a mobile phone user, once s/he has enabled a service, consents to be located by another, when that other person initiates a location request (either from another mobile phone or from a PC).
WAP/WML: Wireless Application Protocol and Wireless Mark up Language; the protocol used by mobile phones to browse content sites (including those on the Internet) written in WML.

ANNEX B - Obtaining consent (for child location and friend location services)
All locatees must provide to the LSP a consent to be located before any location service is activated
Before giving his or her consent, a locatee must be informed of the following:
• that someone wishes to locate their mobile phone;
• name and phone number of prospective locator;
• website or customer support number where further service information including safety advice and terms and conditions are available; and
• the service name and location service provider name.

As an example the following text may be sent to the locatee as an SMS when a locator first requests the ability to locate them:

[NAME] [PHONE NUMBER] wants to locate your mobile from now on. Text [SERVICE NAME] YES [NAME] +[activation code] to [SERVICE NUMBER] to agree. [SERVICE WEBSITE] by [PROVIDER NAME]."

The request for consent should refer to a web site or other materials, where detailed information can be obtained about the nature of the service, safety advice and the rights of the locatee.
If consent is refused, the service must not be activated – even if the location service has been requested by a parent.


ANNEX C - Random alerts for child location services
Confidential Annex

ANNEX D -Random alerts for friend location services
Confidential Annex

ANNEX E - Stopping, suspending service
It is strongly recommended that "STOP" be used as the command to stop a service either temporarily or permanently. "START" may be used to (re-)start a stopped or suspended service.
As an example the following text may be sent by the locatee as an SMS when de-activating a service which allows an individual to locate a child:

"STOP [SERVICE NAME] [NAME]" to [SERVICE NUMBER]

When de-activating all locators on a location service operated by a LSP:

"STOP [SERVICE NAME] ALL" to [SERVICE NUMBER]

Premium rate voice calls or premium SMS services should not be used for the de-activation of location services.

Where appropriate, LSPs should ensure that either:
• advisory messages are sent to the locator when a de-activation request is made by the locatee; or
• location status is available to locators to reflect a stopped or suspended service.
• The LSP will act on a “STOP” message on receipt.


ANNEX F - Location services and you
Location services work by identifying the physical location of a mobile phone or other mobile device. This could be your own mobile phone or the mobile phone of a relative, friend or work colleague.
A wide range of new services are possible using location services including telling you how to get to the nearest cash machine or chemist; allowing a parent to identify the location of his or her child; making it easier for friends to meet up for an evening out; and assisting firms with the security of lone workers.
All location services are subject to the legal requirements of the Data Protection Act. For consumers this means that location information can be used only after consent is provided by the user of the phone being located. For business users employers must explain to their employees how location information will be used before it is collected.
The Data Protection Act requires that customers are made aware of:
• who their location service company is;
• the purposes for which personal data - including location information - will be collected and processed;
• whether data will be sent to a third party for the purpose of providing the location service and length of time for processing data, including storage, will be.
In addition to data protection legislation, participants in the UK location services industry - including both location service providers and mobile phone operators - have agreed a Code of Practice for the provision of location services. This Code of Practice sets out additional requirements for different types of location services. This includes requirements relating to:
• registration of individuals and organisations using location information;
• provision of reminders on location services operating on a mobile phone;;
• how customers can stop a locating service which is running on their phone; and
• responsibilities of a locating business or other organisation.
While details vary, all location services depend on the disclosure of where you are to companies or to other individuals. This offers you significant opportunities to use new services. However, these services should be used with the same care as you would take in telling other people your location in a phone call or SMS. Further, unlike a phone call or SMS, they can provide information on your location over a period of time.
Only consent to the use of your location information if you would be willing to provide the same company or individual with details of where you are in a phone call or SMS. Be aware that your consent may apply for a period of time. Don’t forget that you can withdraw your consent to being located at any time.
If you have any concerns about your safety which relate to the operation of any location service then you should contact your location service company.
If you have immediate safety concerns then you should, as in other circumstances, contact the police by dialling 999 or 112.
If a user of a location service believes that the industry Code of Practice are being breached by the location service provider, he or she may contact the Mobile Broadband Group by e-mail at mobilebg@btopenworld.com or write to The Secretariat, Mobile Broadband Group, PO Box 34586, London SE15 5YA.


ANNEX G - Extract from SI on Privacy and data protection
EXTRACT FROM STATUTORY INSTRUMENT – 2003 NO.2426 ELECTRONIC COMMUNICATIONS – THE PRIVACY AND ELECTRONIC COMMUNICATIONS (EC DIRECTIVE) REGULATIONS 2003
Restrictions on the processing of location data 14. - (1) This regulation shall not apply to the processing of traffic data. (2) Location data relating to a user or subscriber of a public electronic communications network or a public electronic communications service may only be processed -
(a) where that user or subscriber cannot be identified from such data; or (b) where necessary for the provision of a value added service, with the consent of that user or subscriber.
(3) Prior to obtaining the consent of the user or subscriber under paragraph (2)(b), the public communications provider in question must provide the following information to the user or subscriber to whom the data relate -
(a) the types of location data that will be processed; (b) the purposes and duration of the processing of those data; and (c) whether the data will be transmitted to a third party for the purpose of providing the value added service.
(4) A user or subscriber who has given his consent to the processing of data under paragraph (2)(b) shall -
(a) be able to withdraw such consent at any time, and (b) in respect of each connection to the public electronic communications network in question or each transmission of a communication, be given the opportunity to withdraw such consent, using a simple means and free of charge.
(5) Processing of location data in accordance with this regulation shall -
(a) only be carried out by -
(i) the public communications provider in question; (ii) the third party providing the value added service in question; or (iii) a person acting under the authority of a person falling within (i) or (ii); and
(b) where the processing is carried out for the purposes of the provision of a value added service, be restricted to what is necessary for those purposes.


ANNEX H - Working Group participants

This Code of Practice has been complied for use by all location service providers. The working group compiling the Code of Practice has comprised of representatives from the following organisations:


3
Britannic 3G Services
Creativity Software
Follow Us
MI International
Mobile Commerce
Multimedia Messaging Systems/mTrack
MX Telecom
O2
Orange
Ordnance Survey
T-Mobile
Trackaphone
Vodafone

Download as PDFDownload

Location Based Service solutions for Telco and Service Providers
Location Based Service solutions for Enterprises
Location Based Service Solutions for Content Owners
Location Based Service Solutions for Device Manufacturers
Location Based Services brought to you by Creativity Software Ltd