This is material for the Eyes Online Scottish Universities Insight Institute event in February 2020, concerning making data requests to mobile phone companies for mast and location data. It may be useful to others too.

The emails of the major providers' data protection teams are here; if you use a smaller provider it should be provided in their privacy policy. If you cannot find a privacy-specific email, any customer services email will suffice.

• DPO@o2.com.
• CPO@bt.com
• DPA.Officer@three.co.uk
• customerdataquery@vodafone.com

Template Letter Follows:

To whom it concerns,

I am writing to request a copy of my call records, data usage records, the observed location I was at when my device connected to the mobile phone network (including as applicable co-ordinates, postcode, country, mast location and identity and other relevant geographic indicators), and any profiles made of my behaviour (such as estimated mode of transport). It relates to all time periods for which you hold this data. This request is under Article 15 of the GDPR.

Please note that in line with the GDPR, access requests can be made in any format, and the Information Commissioner explicitly specifies in the Subject Access Code of Practice that I am not obliged to use an online or PDF form. Please do not send me one in response.

My account details are below:

• Phone Number:
• Account Number:
• Address:
• Name:
• Email on Account:
• OPTIONAL (BUT WILL BE ASKED IN RESPONSE, SO EASIER TO ATTACH NOW)  An identity document is attached.

I await your response within a calendar month of this requst.

Best regards,

NAME