alt Hacker News50M+ subs operator, at least 10 employees can have both location and CRM data, I guess it's pretty typical.
> As someone who has access to such data at a telco
so you do have access :)
> - Lawful interception and emergency services use completely separate paths, exposed via user interfaces that aren't available to employees.
correct for LI, not for emergency.
> Also why not simply switch to a different phone operator?
yes, the only solution.
> 50M+ subs operator, at least 10 employees can have both location and CRM data, I guess it's pretty typical.
This shouldn't be the case anywhere in Europe or regions with similar laws. And we have a lot less than 50M subscribers.
Anyway, there's really nothing that justifies having access to both. If you work on network quality and need enriched traces, personal data is completely useless. Most business cases don't even need stable, let alone clear IMSI. Very few people will need to look at a clear MSISDN for troubleshooting, and if you do things properly they shouldn't get blanket access to terabytes of daily telemetry.
Aggregated CRM data can be useful to more high-level business cases, nothing that can be used to identify someone personally. Our data governance office doesn't even let us correlate anonymized and GDPR compliant data that we buy from third parties when the IDs are too stable, as it'd be fairly easy to match raw network traces.
> so you do have access :)
No I don't. Sometimes people move to different teams you know, and access to datasets I had in the past is mutually exclusive with some that I do have now.
> correct for LI, not for emergency.
If people that can see E112 payloads with GNSS locations exist, then I don't know they are, but I'm sure they can't have access to stuff relevant to the discussion here. On the network telemetry side, our job is monitoring and quality assurance. Anyway this kind of data is too sparse to be abused by a stalker.