DATA PROTECTION IMPACT ASSESSMENT
DPIA-011
Transfer of Network Performance and Subscriber Analytics Data to Caldwell Analytics Inc. (United States)
This document is prepared by Calderwood & Harkness LLP on the instruction of Northgate Telecommunications PLC and is protected by legal professional privilege. It must not be disclosed to any third party without the prior written consent of Calderwood & Harkness LLP and Northgate Telecommunications PLC, save as may be required to be disclosed to the Information Commissioner's Office ("ICO"), the Data Protection Commission ("DPC"), or other competent supervisory authority in connection with regulatory proceedings or inquiries.
Right-click to update Table of Contents
1. Introduction and Purpose
1.1 Background to this DPIA
This Data Protection Impact Assessment ("DPIA") is prepared pursuant to Article 35 of the United Kingdom General Data Protection Regulation (the "UK GDPR") and Article 35 of Regulation (EU) 2016/679 (the "EU GDPR") as part of a comprehensive GDPR compliance programme build commissioned by Northgate Telecommunications PLC ("NTP" or the "Controller") and undertaken by Calderwood & Harkness LLP ("C&H"). The engagement was opened on 13 February 2023 under engagement reference SC/NTP/2023-0213/PDS. The engagement is structured across six phases, of which Phase 3 — Data Protection Impact Assessments — commenced on 22 May 2023 and concluded with the finalisation of the last DPIA on 28 July 2023.
This DPIA (designated DPIA-011) was completed on 7 July 2023. It is one of eleven DPIAs conducted during Phase 3 of the engagement. Of those eleven, five have been classified as high-risk and require detailed mitigation plans. Those five high-risk DPIAs are as follows:
• DPIA-001: Direct marketing analytics — profiling of consumer subscribers for targeted marketing campaigns.
• DPIA-003: Employee monitoring — processing of employee communications and device activity data.
• DPIA-007: Fraud detection and prevention — automated decision-making system.
• DPIA-008: Third-party data sharing with content delivery partners — international transfer.
• DPIA-011: Transfer of network performance and subscriber analytics data to Caldwell Analytics Inc. (United States) — the subject of this assessment.
The decision to undertake a comprehensive GDPR programme build, including the conduct of DPIAs for all high-risk processing activities, was made by the NTP Board Audit & Risk Committee pursuant to a formal resolution dated 8 December 2022. That resolution followed an internal audit conducted in Q3 2022, which identified material gaps in NTP's data protection governance framework, and was further prompted by the prior enforcement action taken by the ICO against NTP in 2021 (discussed further at Section 1.3 below).
1.2 Purpose and Scope
The purpose of this DPIA is to:
1. Assess the data protection risks associated with NTP's transfer of pseudonymised subscriber analytics data to Caldwell Analytics Inc. ("Caldwell") in the United States for the purpose of AI-driven network analytics and predictive maintenance services.
2. Evaluate the necessity and proportionality of the processing, including consideration of alternative approaches and the application of data minimisation principles.
3. Identify risks to the rights and freedoms of data subjects and assess the likelihood and severity of those risks, including but not limited to risks arising from the international transfer of personal data to a jurisdiction that does not benefit from an adequacy decision.
4. Assess mitigation measures, including technical, contractual, and organisational supplementary measures designed to reduce identified risks to an acceptable level.
5. Analyse the legal framework of the destination country (United States) as it pertains to government access to, and surveillance of, personal data held by entities such as Caldwell. This analysis cross-references the companion Transfer Impact Assessment prepared under reference TIA-001 (Transfer Impact Assessment: NTP → Caldwell Analytics Inc. (US)), which provides a detailed assessment of US surveillance law and its implications for the transfer.
6. Assess supplementary measures required under the framework established by the Court of Justice of the European Union in Data Protection Commissioner v. Kestrel Services Inc. Ireland Limited and Maximillian Schrems (Case C-311/18, 16 July 2020) ("Schrems II") and the subsequent guidance issued by the European Data Protection Board ("EDPB").
The scope of this DPIA encompasses the entire end-to-end data processing lifecycle associated with the transfer, from the initial collection of raw network performance data by NTP, through pseudonymisation and transfer, to processing by Caldwell and the return of analytics outputs to NTP. It addresses both UK personal data (originating from NTP PLC's UK operations) and EU personal data (originating from NTP's EU subsidiary operations, including Northgate Ireland Ltd, Northgate GmbH, Northgate B.V., Northgate France SAS, and Northgate Iberia S.L.).
1.3 Regulatory Context
The regulatory context in which this DPIA is prepared is characterised by heightened scrutiny of international data transfers, particularly those involving the United States, and by specific regulatory attention directed at NTP. The following matters are material to this assessment:
Adequacy status of the United States. The United States does not benefit from a general adequacy decision under the EU GDPR for commercial data transfers. While the European Commission adopted the EU-US Data Privacy Framework ("DPF") adequacy decision on 10 July 2023 (Commission Implementing Decision (EU) 2023/1795), that framework applies only to transfers to US organisations that have self-certified under the DPF. As at the date of this DPIA, Caldwell's participation status under the DPF has not been confirmed, and the scope of the DPF (including limitations relating to bulk collection of data under Executive Order 14086) remains subject to analysis. TIA-001 addresses the DPF in detail. Under the UK GDPR, the United States similarly lacks a general adequacy finding for the data types and processing activities in question. The UK Government's extension of adequacy regulations to the US under the UK-US Data Bridge was under development at the time of this assessment but had not been finalised.
Prior ICO Enforcement Notice. On 15 September 2021, the ICO issued an Enforcement Notice to NTP under reference ENF/2021/0934, accompanied by a monetary penalty of £320,000. The enforcement action concerned NTP's inadequate consent mechanisms for the processing of subscriber data for direct marketing purposes through the NorthCloud consumer platform. While the subject matter of that enforcement action differs from the processing assessed in this DPIA, the enforcement history is relevant because it demonstrates heightened regulatory scrutiny of NTP's data protection practices and underscores the importance of ensuring robust compliance measures are in place across all processing activities.
Active DPC Preliminary Inquiry. The Data Protection Commission (Ireland) ("DPC") opened a preliminary inquiry under reference IN-22-11-3 in November 2022, specifically concerning cross-border data transfers from Northgate Ireland Ltd to US-based processors. This DPIA and the associated transfer to Caldwell fall directly within the scope of that inquiry. The DPC inquiry was initiated following a complaint lodged by the Irish Council for Civil Liberties and relates to the adequacy of transfer safeguards and supplementary measures applied by NTP's EU subsidiaries. NTP, through its EU establishment Northgate Ireland Ltd (Unit 12, Grand Canal Dock Business Centre, Barrow Street, Dublin 2, D02 KV92, Companies Registration Office Number 587214), has been cooperating with the DPC throughout the inquiry process.
Lead Supervisory Authorities. For the purposes of EU GDPR cross-border processing, NTP's lead supervisory authority is the DPC (Ireland), by virtue of NTP's EU establishment through Northgate Ireland Ltd in Dublin. For UK GDPR purposes, the relevant supervisory authority is the Information Commissioner's Office ("ICO"). NTP's ICO registration number is ZA482917.
The combination of these regulatory factors — the absence of an adequacy decision, prior enforcement history, and an active supervisory authority inquiry directly concerning the category of transfer at issue — makes this DPIA a matter of critical importance to NTP's regulatory posture and compliance strategy.
1.4 Legal Basis for Conducting this DPIA
This DPIA is required as a matter of law. Article 35(1) of the UK GDPR and Article 35(1) of the EU GDPR require that, where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. The processing assessed in this DPIA meets multiple criteria that trigger the DPIA requirement:
• Article 35(3)(a): The processing involves systematic and extensive evaluation of personal aspects relating to natural persons, based on automated processing, including profiling. Caldwell's AI-driven analytics generate usage profiles and behavioural patterns derived from network performance data associated with individual (pseudonymised) subscribers.
• Article 35(3)(b): The processing involves processing on a large scale of personal data. Approximately 4.2 million unique pseudonymised subscriber records are transferred to Caldwell over a twelve-month period, drawn from a total subscriber base of approximately 6.3 million consumer subscribers and 42,000 enterprise client end-users.
• International transfer to a third country: The transfer of personal data to the United States, a jurisdiction that does not benefit from an adequacy decision under EU or UK GDPR (subject to the caveats discussed regarding the DPF), is identified in ICO guidance, EDPB guidelines, and the Article 29 Working Party's guidelines (WP 248 rev.01, as endorsed by the EDPB) as a factor that contributes to the high-risk classification of processing and supports the triggering of the DPIA requirement.
This assessment has been prepared in accordance with the EDPB's Guidelines on Data Protection Impact Assessments (WP 248 rev.01), the ICO's DPIA guidance (last updated March 2023), and Article 35(7) of the UK GDPR/EU GDPR, which specifies the minimum content of a DPIA.
2. Description of the Processing
2.1 Nature of the Processing
NTP transfers pseudonymised subscriber analytics data to Caldwell pursuant to a Master Services Agreement dated 1 June 2021 (the "MSA"). Under the MSA, Caldwell provides AI-driven network analytics and predictive maintenance services to NTP. These services are designed to enable NTP to optimise its telecommunications network infrastructure, predict and prevent network failures, and make informed capacity planning decisions based on data-driven insights generated by Caldwell's proprietary machine learning algorithms.
The data is transferred from NTP's data centres located in London (United Kingdom), Frankfurt (Germany), Amsterdam (Netherlands), and Dublin (Ireland) to Caldwell's infrastructure in San Jose, California, United States. The transfer originates from NTP's centralised data lake, which is hosted by Pinnacle Cloud Services Ltd ("Pinnacle") across its London and Dublin data centre facilities, and terminates at Caldwell's proprietary analytics platform, which is hosted in Caldwell-operated data centres in San Jose.
The processing activities performed by Caldwell include:
• Ingestion of pseudonymised network performance data received from NTP.
• Algorithmic analysis using Caldwell's proprietary machine learning models, including deep learning neural networks trained on telecommunications network data.
• Anomaly detection to identify irregular patterns in network performance that may indicate emerging faults or degradation.
• Predictive failure modelling to forecast network element failures before they occur, enabling proactive maintenance.
• Generation of analytics reports and dashboards that are returned to NTP via secure API, providing NTP's network operations and engineering teams with actionable intelligence.
In this arrangement, Caldwell acts as a data processor within the meaning of Article 4(8) of the UK GDPR and EU GDPR. NTP remains the data controller. Caldwell processes the data solely on NTP's documented instructions and for the purposes specified in the MSA and Data Processing Agreement ("DPA"). Caldwell does not determine the purposes or means of the processing.
Both UK personal data (from NTP PLC's operations in the United Kingdom) and EU personal data (from NTP's EU subsidiary operations, including Northgate Ireland Ltd, Northgate GmbH (Germany), Northgate B.V. (Netherlands), Northgate France SAS (France), and Northgate Iberia S.L. (Spain)) are transferred to Caldwell under the same arrangements. The transfer mechanisms applicable to each jurisdiction are discussed at Section 2.7 below.
2.2 Categories of Personal Data Transferred
The following categories of personal data are transferred to Caldwell:
1. Subscriber metadata — call detail records ("CDRs"): CDRs include timestamps of subscriber communications, duration of calls and data sessions, and communication endpoints (i.e., the originating and terminating identifiers for each communication). All CDRs are pseudonymised prior to transfer; direct subscriber identifiers are replaced with pseudonymous keys generated by NTP's pseudonymisation engine.
2. Location data: Cell-tower level geolocation data associated with subscriber connections. This data indicates the cell tower to which a subscriber's device was connected at a given point in time, providing geolocation information at a resolution determined by cell tower density (typically within a radius of several hundred metres in urban areas and several kilometres in rural areas). Location data is pseudonymised prior to transfer — direct subscriber identifiers are replaced with pseudonymous keys, and no subscriber names, addresses, or account numbers are associated with the location data at the point of transfer.
3. Device identifiers: International Mobile Equipment Identity ("IMEI") numbers, Media Access Control ("MAC") addresses, and Subscriber Identity Module ("SIM") identifiers associated with subscriber devices. These identifiers are hashed using salted hashing algorithms prior to transfer; the original device identifiers are not transferred in cleartext. The salt values are rotated on a quarterly basis.
4. Network performance metrics associated with individual connections: Metrics including latency, throughput (upload and download speeds), signal strength (RSSI/RSRP), packet loss rates, and handover events. These metrics are associated with individual pseudonymised subscriber sessions and are used by Caldwell's ML models to assess network quality at the per-connection level.
5. IP addresses: Internet Protocol addresses associated with subscriber data sessions. IP addresses are truncated and pseudonymised prior to transfer; the final octet (IPv4) or the final 80 bits (IPv6) are removed, and a pseudonymous key is appended.
Critically, direct identifiers — including subscriber name, postal address, email address, telephone number, account number, and billing information — are NOT transferred to Caldwell. Pseudonymisation is applied by NTP's pseudonymisation engine prior to any data extraction for transfer. The re-identification key, which maps pseudonymous keys back to direct identifiers, is held exclusively by NTP within its UK and EU infrastructure and is never shared with, or accessible to, Caldwell.
Notwithstanding the pseudonymisation applied, the data transferred to Caldwell constitutes personal data for the purposes of the UK GDPR and EU GDPR. Pseudonymised data retains its character as personal data because it can, in principle, be attributed to identifiable natural persons through the use of additional information (i.e., the re-identification key held by NTP). This is consistent with Recital 26 of the GDPR and the guidance of the Article 29 Working Party on anonymisation techniques (Opinion 05/2014).
2.3 Categories of Data Subjects
The data subjects whose personal data may be transferred to Caldwell fall into two broad categories:
• Consumer subscribers: Approximately 6.3 million consumer subscribers across NTP's UK and EU operations who use NTP's mobile and fixed-line telecommunications services, including services provided under the NorthCloud consumer brand. These individuals are resident in the United Kingdom, Ireland, Germany, the Netherlands, France, and Spain.
• Enterprise client end-users: Approximately 42,000 end-users of enterprise client organisations whose network traffic traverses NTP infrastructure under enterprise service agreements. These individuals are employees or agents of NTP's enterprise clients who use NTP's telecommunications infrastructure as part of their business operations.
It is important to note that not all data subjects' data is transferred to Caldwell at any given time. Caldwell's analytics processing is performed on rolling datasets selected by NTP based on network segments and time windows relevant to specific analytics projects. Over a twelve-month period, the estimated volume of unique data subject records transferred to Caldwell is approximately 4.2 million pseudonymised records.
2.4 Purpose of the Processing
The processing is undertaken for the following specific, explicit, and legitimate purposes:
1. Network optimisation: Identifying underperforming network segments, bottlenecks, and areas of suboptimal coverage through analysis of granular, per-connection performance data. The analytics outputs enable NTP's network engineering teams to prioritise remedial interventions and infrastructure upgrades.
2. Predictive maintenance: Reducing unplanned network outages through machine learning-driven anomaly detection. Caldwell's predictive models analyse historical and real-time performance data to forecast network element failures (e.g., base station hardware degradation, backhaul congestion) before they result in service disruptions.
3. Capacity planning: Informing NTP's network investment decisions by providing data-driven insights into usage patterns, demand trends, and projected capacity requirements across different network segments and geographic regions.
4. Quality of service improvement: Enhancing the overall subscriber experience through data-driven network management, including identification of recurring service quality issues affecting specific geographic areas or subscriber segments.
The processing does not involve any direct decision-making about individual data subjects. No individual subscriber is subject to any action, decision, or outcome based on the analytics outputs generated by Caldwell. The outputs are used solely to inform infrastructure-level decisions about NTP's telecommunications network.
2.5 Data Flows
The end-to-end data flow associated with this processing activity is described below. A visual data flow diagram is provided at Annex A.
Step 1 — Collection of raw network performance data. Raw network performance data is collected from NTP's network elements, including switches, routers, base stations (eNodeB and gNB), and core network components, across NTP's UK and EU infrastructure. This collection is an inherent function of NTP's network management systems and occurs continuously as part of normal network operations.
Step 2 — Ingestion into NTP's centralised data lake. The raw data is ingested into NTP's centralised data lake, which is hosted by Pinnacle Cloud Services Ltd (Company Number 09142837, Apex House, 24 Victoria Embankment, London EC4Y 0DZ) in its London and Dublin data centre facilities. Pinnacle provides Infrastructure-as-a-Service ("IaaS") hosting for the data lake under a separate services agreement with NTP, governed by a Data Processing Agreement between NTP and Pinnacle dated 28 June 2023. The data lake aggregates raw performance data from all network elements and associates it with subscriber session records, including CDRs, device identifiers, IP addresses, and location data.
Step 3 — Pseudonymisation. Before any data is extracted for transfer to Caldwell, NTP's pseudonymisation engine applies pseudonymous keys, hashes device identifiers using salted algorithms, and truncates IP addresses. The pseudonymisation engine is operated by NTP's Chief Information Security Officer ("CISO") team, under the oversight of Thomas Okoye (CISO, NTP). The pseudonymisation process is automated and applied to all data destined for transfer. The re-identification key — which enables the mapping of pseudonymous keys back to direct subscriber identifiers — is stored exclusively within NTP's UK infrastructure and is accessible only to a restricted group of authorised NTP personnel. Caldwell has no access to the re-identification key.
Step 4 — Transfer to Caldwell. The pseudonymised dataset is extracted from the data lake and transferred to Caldwell's analytics platform in San Jose, California via an encrypted channel using Transport Layer Security ("TLS") version 1.3. Transfers are conducted in batch mode on a scheduled basis (typically daily) and, where required, on an ad hoc basis for specific analytics projects. Each transfer is logged in NTP's data transfer register, recording the date, volume, and a confirmation that pseudonymisation has been applied.
Step 5 — Processing by Caldwell. Caldwell processes the pseudonymised data using its proprietary machine learning models. Processing includes data cleaning, feature engineering, model training and inference, anomaly detection, and predictive analysis. All processing takes place within Caldwell's data centres in San Jose, California.
Step 6 — Return of analytics outputs. Analytics reports, dashboards, and alert notifications are returned to NTP via a secure API connection. The analytics outputs contain aggregated and anonymised insights at the network segment level; they do not contain pseudonymous keys or any data that would enable re-identification of individual data subjects. Analytics outputs are received by NTP's network operations and engineering teams.
Step 7 — Retention by Caldwell. Pseudonymised data is retained by Caldwell for the purpose of model training and improvement, subject to the retention periods specified in the DPA and EU Standard Contractual Clauses ("SCCs"). Upon termination or expiry of the MSA, Caldwell is contractually obligated to delete or return all NTP data in accordance with the terms of the DPA.
2.6 Technology and Infrastructure
The following technology and infrastructure are involved in the processing:
NTP side:
• Data lake hosting: Pinnacle Cloud Services Ltd provides IaaS hosting for NTP's centralised data lake in its London (Docklands) and Dublin (Tallaght) data centre facilities. Pinnacle's infrastructure is ISO 27001 certified and SOC 2 Type II audited.
• Pseudonymisation engine: A custom-built data processing pipeline developed and maintained by NTP's engineering team under the direction of Laura Dearden (VP, Product & Engineering). The engine applies tokenisation, salted hashing, and IP truncation to all data destined for transfer.
• Encryption at rest: AES-256 encryption is applied to all data stored in the NTP data lake.
• Encryption in transit: TLS 1.3 is used for all data transfers between NTP infrastructure and Caldwell's analytics platform.
Caldwell side:
• Caldwell operates a proprietary analytics platform hosted in Caldwell-operated data centres located in San Jose, California. Derek Rawlings (CTO, Caldwell Analytics Inc.) is responsible for data infrastructure and security controls.
• Encryption at rest: AES-256 encryption is applied to all NTP data stored in Caldwell's systems. Encryption keys are managed by Caldwell and are subject to key management auditing by NTP.
• Access controls: Role-based access control ("RBAC") is implemented across Caldwell's analytics platform. Access to NTP data is limited to Caldwell's analytics engineering team, comprising approximately 35 authorised individuals. Multi-factor authentication ("MFA") is required for all access. The principle of least privilege is enforced.
• Security certifications: Caldwell holds SOC 2 Type II certification (most recent report dated March 2023) and ISO 27001 certification (certificate number ISO-27001-CA-2022-0847, certified by Bureau Veritas).
2.7 Contractual Framework
The contractual framework governing the transfer comprises the following instruments:
1. Master Services Agreement ("MSA"): Dated 1 June 2021, between NTP and Caldwell, establishing the commercial terms for Caldwell's provision of network analytics and predictive maintenance services.
2. EU Standard Contractual Clauses (Module 2: Controller to Processor): Executed on 17 July 2023 between NTP (as data exporter and controller) and Caldwell (as data importer and processor), pursuant to the European Commission's Implementing Decision (EU) 2021/914. Module 2 (Controller to Processor) has been selected to reflect the parties' respective roles.
3. UK International Data Transfer Agreement ("IDTA"): Executed on 17 July 2023 for the purposes of UK personal data transfers, pursuant to the ICO's approved IDTA template.
4. Data Processing Agreement ("DPA"): Incorporated into the MSA and updated in connection with the execution of the EU SCCs and UK IDTA to ensure alignment with GDPR requirements, including data subject rights assistance, breach notification obligations, sub-processor controls, and audit rights.
5. Caldwell's external legal counsel: Hargrove Lister & Webb LLP, represented by Natalie Prescott (Partner, Data Privacy & Cybersecurity), with principal office at 555 Mission Street, Suite 3100, San Francisco, CA 94105, and London office at 30 Fenchurch Street, London EC3M 3BD. Hargrove Lister & Webb LLP participated in the negotiation of the EU SCCs, UK IDTA, and amended DPA.
The negotiation and execution of the EU SCCs and UK IDTA were completed during Phase 4 of the C&H engagement (International Transfers), in parallel with the finalisation of this DPIA during Phase 3. The contractual instruments were executed on 17 July 2023, ten days after the completion of this DPIA in draft, to ensure that the transfer mechanism documentation reflected the risk mitigation measures identified through the DPIA process.
3. Assessment of Necessity and Proportionality
3.1 Lawful Basis for Processing
The lawful basis relied upon by NTP for the processing described in this DPIA is legitimate interest under Article 6(1)(f) of the UK GDPR and the EU GDPR. NTP does not rely on consent, contractual necessity, or any other lawful basis for this processing activity.
NTP's legitimate interests in this processing are as follows:
• Maintaining and optimising telecommunications infrastructure to ensure reliable, high-quality service delivery to its subscribers, consistent with its obligations under its telecommunications licences and its commercial commitment to service quality.
• Preventing network outages through predictive maintenance, thereby reducing subscriber impact and the associated operational and reputational costs of service disruptions.
• Efficient capacity planning to ensure that NTP's capital expenditure on network infrastructure is directed to areas of greatest need, based on data-driven analysis of usage patterns and demand trends.
A Legitimate Interest Assessment ("LIA") was conducted for this processing activity as part of Phase 2 (Lawful Basis Assessment) of the C&H engagement. This processing activity is one of 64 activities across NTP's operations that rely on legitimate interest as the lawful basis, out of a total of 147 catalogued processing activities.
The balancing test conducted as part of the LIA reached the following conclusion:
• NTP's interests in network reliability, service quality, and efficient infrastructure investment are substantial and compelling. As a major telecommunications provider serving over 6.3 million subscribers, NTP has a significant commercial and public interest in maintaining a reliable network.
• The processing uses pseudonymised data, which significantly reduces the impact on data subjects. Direct identifiers are not transferred to Caldwell, and the re-identification key is held exclusively by NTP.
• Data subjects have reasonable expectations that their network usage data will be used by NTP for the purposes of maintaining and optimising the telecommunications services they use. The use of network performance data for infrastructure analytics is a normal and expected function of a telecommunications operator.
• The processing does not involve any direct decision-making about individual data subjects. No subscriber is subject to any action, consequence, or differential treatment based on the analytics outputs.
• The residual risk to data subjects, taking into account the pseudonymisation applied and the supplementary measures implemented, is not disproportionate to NTP's legitimate interests.
3.2 Necessity of Processing
The transfer of data to Caldwell for AI-driven analytics is necessary because:
1. Specialist expertise and computational resources: The AI-driven analytics processing requires specialist machine learning expertise and significant computational resources that are not currently available within NTP's in-house capabilities. Caldwell has developed proprietary predictive maintenance algorithms specifically designed for telecommunications network data, and these algorithms have demonstrated measurable improvements in network uptime and fault prediction accuracy as documented in the MSA performance metrics and Caldwell's quarterly performance reports to NTP.
2. Assessment of alternatives: NTP and C&H conducted an assessment of alternative approaches prior to concluding that the transfer to Caldwell is necessary:
(a) Building in-house capability: Assessed as requiring 18 to 24 months of development time, significant capital investment (estimated at £12–15 million for talent acquisition, infrastructure, and model development), and ongoing operational expenditure. This option was assessed as not viable in the short to medium term given NTP's immediate need for network analytics capability.
(b) Using EU/UK-based analytics providers: A vendor assessment was conducted in Q4 2020 and Q1 2021. No comparable provider was identified within the EU or UK that offered equivalent capability in AI-driven telecommunications network analytics. Two EU-based providers were evaluated (Telemetrix AG, Munich, and DataPulse B.V., Rotterdam) but neither offered predictive maintenance modelling at the scale and sophistication required by NTP.
(c) Processing data without international transfer: The possibility of Caldwell establishing an EU or UK processing facility was discussed with Caldwell during contract negotiations in 2021. Caldwell confirmed that it has no current data centre presence in the EEA or United Kingdom and assessed the establishment of such a facility as impractical in the short to medium term, given the significant infrastructure investment required and the centralised architecture of its analytics platform.
3. Demonstrated value: Since the commencement of services under the MSA in September 2021, Caldwell's analytics have contributed to a measurable reduction in unplanned network outages (NTP internal reporting indicates a 23% reduction in mean time to detection of network faults since deployment) and have informed £48 million in targeted network infrastructure investments.
3.3 Proportionality
The processing is proportionate to its objectives for the following reasons:
Data minimisation. Only pseudonymised network performance data is transferred to Caldwell. NTP has carefully scoped the categories of data transferred to include only those data elements that are necessary for Caldwell's analytics processing. Direct identifiers (subscriber name, address, email, telephone number, account number, billing information) are never transferred. Content data (the substance of communications) is never transferred. The pseudonymisation applied pre-transfer is a core component of NTP's data minimisation strategy.
Purpose limitation. Caldwell is contractually restricted to processing the transferred data solely for the purposes of providing network analytics services on NTP's behalf, as specified in the MSA and DPA. No secondary use of the data is permitted. Caldwell is expressly prohibited from using the data for its own purposes, for the benefit of other clients, or for any purpose not documented in NTP's written instructions.
Storage limitation. The DPA and EU SCCs specify retention periods for the pseudonymised data held by Caldwell. Data is retained only for as long as necessary for the performance of the analytics services and model training. Upon termination or expiry of the MSA, Caldwell is obligated to delete or return all NTP personal data in accordance with the DPA, and to certify in writing that deletion has been completed.
Pseudonymisation as a proportionality safeguard. The pseudonymisation applied by NTP prior to transfer is a materially significant safeguard that fundamentally affects the proportionality analysis. By ensuring that Caldwell never receives direct identifiers and has no access to the re-identification key, NTP has substantially reduced the risk that the transferred data could be used to identify or affect individual data subjects. The re-identification key is held exclusively by NTP within its UK and EU infrastructure. Caldwell is contractually prohibited from attempting to re-identify any data subject from the pseudonymised data, whether through cross-referencing with other datasets or by any other means.
3.4 Data Subject Rights
Data subjects retain the full suite of rights available under the UK GDPR and EU GDPR in relation to the processing assessed in this DPIA. These rights are facilitated as follows:
• Data subjects may exercise their rights — including access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), objection (Article 21), and data portability (Article 20) — by contacting NTP as the data controller. NTP's Data Subject Rights Procedure, prepared during Phase 5 of the C&H engagement, establishes detailed operational processes and service level agreements for the handling of data subject requests.
• Caldwell is contractually obligated under the DPA and the EU SCCs to assist NTP in responding to data subject requests. This includes, where applicable, assisting NTP in locating and deleting pseudonymised records within Caldwell's systems in response to verified erasure requests.
• Information about the transfer to Caldwell is disclosed in NTP's revised Privacy Notice for NorthCloud consumer subscribers, which was updated during Phase 6 of the C&H engagement to include transparent disclosures about international data transfers, the categories of data transferred, the purposes of processing, and the safeguards applied.
• NTP maintains the capability to map pseudonymous keys to subscriber identities and therefore to fulfil access and erasure requests in relation to data held by Caldwell, notwithstanding the pseudonymisation applied.
4. Identification and Assessment of Risks
4.1 Risk Framework
Risks have been assessed in this DPIA using a structured risk framework that evaluates each identified risk against two dimensions:
• Likelihood: The probability that the risk will materialise, rated as Remote, Possible, or Probable.
• Severity: The potential impact on the rights and freedoms of data subjects if the risk materialises, rated as Minimal, Significant, or Severe.
The combination of likelihood and severity determines the overall risk level for each identified risk: Low, Medium, High, or Critical. This risk framework is consistent with the approach recommended by the ICO in its DPIA guidance and by the EDPB in its Guidelines on DPIAs (WP 248 rev.01).
The overall risk classification for the processing assessed in this DPIA is HIGH. This classification is based on the following factors, considered individually and in combination:
• Large-scale processing of personal data (approximately 4.2 million pseudonymised records transferred over a twelve-month period).
• International transfer to the United States, a third country without a general adequacy decision.
• Elements of profiling and systematic evaluation of personal aspects through AI-driven analytics.
• The US surveillance framework, which permits government access to data held by entities such as Caldwell under FISA Section 702, Executive Order 12333, and the CLOUD Act.
• The active DPC inquiry (IN-22-11-3) specifically concerning cross-border data transfers from NTP's EU subsidiaries to US-based processors.
Seven specific risks have been identified and are assessed individually below.
4.2 Risk 1 — US Government Surveillance and Access
Description: There is a risk that United States government agencies, including the National Security Agency ("NSA") and the Federal Bureau of Investigation ("FBI"), may compel Caldwell to disclose transferred personal data under Section 702 of the Foreign intelligence Surveillance Act ("FISA"), Executive Order 12333 ("EO 12333"), or the Clarifying Lawful Overseas Use of Data Act (the "CLOUD Act"), without NTP's knowledge or consent and without providing data subjects with effective judicial redress.
Likelihood: Possible. Caldwell is a US-headquartered technology company that provides data analytics services to telecommunications operators. Depending on the scope of its services and the nature of the data it processes, Caldwell may qualify as an "electronic communication service provider" within the meaning of 50 U.S.C. § 1881(b)(4), thereby falling within the scope of FISA Section 702 compelled disclosure orders. Even if Caldwell does not qualify as an electronic communication service provider, it may be subject to compelled disclosure under the CLOUD Act, which permits US law enforcement to compel the production of data held by US-headquartered entities regardless of where the data is stored. The likelihood of a specific intelligence request targeting NTP subscriber data held by Caldwell is assessed as possible rather than probable, given that the data is pseudonymised and its intelligence value is therefore limited. However, the legal framework permits such requests, and the possibility cannot be excluded.
Severity: Severe. If US government agencies were to obtain access to the transferred data and were able to re-identify data subjects (whether through their own auxiliary data sources or through cross-referencing with other datasets), the consequences for data subjects could be severe. Network metadata, location data, and communication patterns can reveal highly sensitive information about individuals' movements, associations, habits, and private lives. The mass surveillance potential inherent in US surveillance law, combined with the absence of equivalent judicial remedies for non-US persons, represents a fundamental deficiency in the US legal framework from the perspective of EU and UK data protection law.
Detailed analysis: This risk is analysed in extensive detail in TIA-001 (Transfer Impact Assessment: NTP → Caldwell Analytics Inc. (US)), prepared by Rachel Bernstein and Sara Hendricks as a companion assessment to this DPIA. TIA-001 analyses the scope of FISA Section 702, including the breadth of the "foreign intelligence information" standard and the absence of individualised judicial warrants for non-US targets. TIA-001 also analyses the bulk collection authorities available under EO 12333, the extraterritorial reach of the CLOUD Act, and the adequacy of the redress mechanisms established under Executive Order 14086 (issued in connection with the EU-US Data Privacy Framework). TIA-001 further evaluates the DPF adequacy decision adopted by the European Commission in July 2023, including its limitations and the unresolved questions regarding the scope of bulk collection safeguards.
Assessment of Caldwell's specific exposure: Caldwell's provision of data analytics services to telecommunications operators means that the nature of the data it processes — network metadata, location data, and communication patterns — may be of particular interest to intelligence agencies engaged in signals intelligence collection. This increases the risk relative to other categories of commercial data. However, the data transferred to Caldwell is pseudonymised, and Caldwell does not hold the re-identification key. This means that even if Caldwell were compelled to disclose data, the disclosed data would not, on its face, identify individual subscribers. The intelligence value of the data without the re-identification key is materially limited, though not eliminated.
Residual risk after mitigation: Moderate. The supplementary measures identified in Section 5 — including pseudonymisation (which limits the utility of any compelled disclosure), contractual obligations on Caldwell to challenge government access requests, and encryption at rest — materially reduce the risk to data subjects. However, these measures cannot eliminate the legal compulsion that US law places on Caldwell, and the residual risk remains moderate.
4.3 Risk 2 — Re-identification of Pseudonymised Data
Description: There is a risk that pseudonymised subscriber data could be re-identified by Caldwell, by US government agencies upon compelled disclosure, or through combination of the pseudonymised data with other available datasets, resulting in the identification of individual data subjects.
Likelihood: Remote to Possible. The likelihood of re-identification depends on the sophistication of the entity attempting re-identification and the availability of auxiliary datasets that could be used to cross-reference the pseudonymised data. For Caldwell personnel, the likelihood is assessed as Remote, given that Caldwell has no access to the re-identification key, no access to NTP's subscriber databases, and is contractually prohibited from attempting re-identification. For US government agencies with access to broader intelligence databases, the likelihood is assessed as Possible, as such agencies may have access to auxiliary datasets (e.g., communications metadata from other sources) that could facilitate re-identification through pattern matching or inference.
Severity: Significant to Severe. If re-identification were to occur, the consequences could be significant to severe. The transferred data includes location data at cell-tower level, which can reveal where a data subject lives, works, and travels. CDRs can reveal patterns of communication, social networks, and daily routines. Device identifiers, even when hashed, may be cross-referenceable if the same devices appear in other datasets. The temporal patterns present in CDRs and location data may allow inference of individual identity even without direct identifiers, particularly for data subjects with distinctive usage patterns.
Factors increasing risk:
• Location data at cell-tower level provides meaningful geolocation information, particularly in urban areas where cell tower density is high.
• Hashed device identifiers, while not reversible in isolation, may be cross-referenced if the same hashing algorithm (even with different salts) is applied to datasets available to the adversary.
• Temporal patterns in CDRs (e.g., regular communication patterns at specific times) may enable inference-based re-identification, particularly when combined with other contextual information.
Factors reducing risk:
• NTP applies pseudonymisation pre-transfer using a purpose-built pseudonymisation engine maintained by the CISO team.
• The re-identification key is held exclusively by NTP and is never shared with or accessible to Caldwell.
• Caldwell is contractually prohibited from attempting re-identification under the DPA and the EU SCCs.
• Hash algorithms used for device identifiers are salted and the salt values are rotated on a quarterly basis, limiting the usefulness of historical hash values to an adversary.
• IP addresses are truncated prior to transfer, removing the most granular geolocation information derivable from IP data.
4.4 Risk 3 — Profiling and Automated Decision-Making
Description: Caldwell's machine learning models generate profiles of network usage patterns that, while intended for infrastructure-level analytics, could theoretically be repurposed for individual-level profiling of data subjects. This raises considerations under Article 22 of the UK GDPR and EU GDPR (automated individual decision-making, including profiling) and engages broader concerns about the generation of behavioural profiles from communication and location metadata.
Likelihood: Remote. The current processing is designed for aggregated and pseudonymised infrastructure analytics. NTP's documented instructions to Caldwell do not authorise any processing that would result in individual-level profiling or automated decision-making affecting data subjects. Contractual prohibitions in the DPA and SCCs restrict Caldwell's use of the data to the specified purposes. There is no evidence that Caldwell has engaged in, or intends to engage in, any repurposing of the data for individual-level profiling.
Severity: Significant. If the ML models were repurposed for individual-level profiling — for example, to generate behavioural profiles of individual subscribers based on their communication patterns and movement habits — this would engage Article 22 considerations and could have significant consequences for data subjects' privacy and autonomy. The capability to generate such profiles exists within Caldwell's technology, even if the current processing does not exercise that capability.
Assessment: The risk is assessed as Low overall (Remote likelihood, Significant severity). However, it is identified and documented because the underlying capability exists, and ongoing monitoring is required to ensure that the contractual purpose limitations are respected. This risk would be reassessed if there were any indication that Caldwell's processing activities were expanding beyond the scope of NTP's documented instructions.
4.5 Risk 4 — Data Breach / Unauthorised Access at Caldwell
Description: There is a risk that a security incident at Caldwell could result in unauthorised access to, or exfiltration of, pseudonymised subscriber data. Caldwell processes data for multiple telecommunications clients and is therefore a potentially attractive target for threat actors seeking access to telecommunications metadata.
Likelihood: Possible. Caldwell is a US technology company with approximately 1,800 employees and $312 million in annual revenue. It processes network analytics data for multiple telecommunications operators globally. The concentration of telecommunications metadata in Caldwell's systems makes it a potentially high-value target for both state-sponsored and criminal threat actors. While Caldwell maintains robust security controls (SOC 2 Type II, ISO 27001), no security posture is immune to breach, and the threat landscape for telecommunications data is assessed as elevated.
Severity: Significant. A breach of pseudonymised location data and communication metadata at scale would be a significant security incident, even though the data is pseudonymised. The pseudonymisation reduces the severity relative to a breach of directly identifiable data, but the volume and sensitivity of the data (location data, CDRs, device identifiers) means that a breach could still result in meaningful harm to data subjects if re-identification were subsequently achieved.
Assessment: Caldwell's security posture was assessed as part of TIA-001. Derek Rawlings (CTO) provided detailed security documentation, including Caldwell's SOC 2 Type II report, ISO 27001 certificate, penetration testing reports, and incident response plan. The assessment concluded that Caldwell's security controls are robust and consistent with industry standards for a company of its size and operating in its sector. However, the inherent risk of breach cannot be eliminated, and the risk is therefore assessed as Medium (Possible likelihood, Significant severity).
4.6 Risk 5 — Inadequate Onward Transfer Controls
Description: There is a risk that Caldwell may engage sub-processors or transfer NTP data onward to third parties without adequate GDPR-compliant safeguards, resulting in loss of NTP's visibility and control over the processing of the transferred data.
Likelihood: Remote. The EU SCCs (Clause 9) and the DPA establish strict controls on Caldwell's engagement of sub-processors. Caldwell's approved sub-processor list is set out in Annex III of the EU SCCs and has been reviewed and specifically authorised by NTP. Any new sub-processor engagement requires prior specific authorisation from NTP. Caldwell is contractually prohibited from engaging any sub-processor not listed in Annex III without NTP's prior written consent. Caldwell's counsel, Natalie Prescott of Hargrove Lister & Webb LLP, has confirmed Caldwell's commitment to these controls.
Severity: Significant. If onward transfers were to occur without adequate safeguards, NTP would lose visibility over the processing of its data, and the supplementary measures implemented to protect data subjects could be undermined.
Assessment: The risk is assessed as Low overall (Remote likelihood, Significant severity), given the contractual controls in place and the specific authorisation mechanism.
4.7 Risk 6 — Inability to Exercise Effective Data Subject Rights
Description: There is a risk that data subjects cannot effectively exercise their GDPR rights (including access, erasure, and objection) in relation to their personal data held by Caldwell in the United States, due to practical challenges in cross-border rights enforcement and the pseudonymised nature of the data.
Likelihood: Possible. Practical challenges exist in exercising data subject rights in relation to pseudonymised data held by a processor in a third country. While NTP, as controller, is responsible for facilitating the exercise of rights, the cross-border dimension introduces potential delays and complexity, particularly in relation to erasure requests that require Caldwell to locate and delete specific pseudonymised records within its systems.
Severity: Minimal to Significant. The severity is mitigated by NTP's controller-level obligations and by Caldwell's contractual cooperation obligations under the DPA and SCCs. NTP retains the re-identification key and can therefore identify the pseudonymous records corresponding to a data subject's request. Caldwell is obligated to implement erasure or restriction instructions received from NTP. The risk of complete inability to exercise rights is low, but practical delays are possible.
Assessment: The risk is assessed as Medium overall (Possible likelihood, Minimal to Significant severity).
4.8 Risk 7 — Regulatory Enforcement and Compliance Risk
Description: There is a risk of enforcement action by the ICO or the DPC arising from inadequate transfer safeguards, particularly given NTP's prior enforcement history and the active DPC inquiry (IN-22-11-3) specifically concerning cross-border data transfers from NTP's EU subsidiaries to US-based processors.
Likelihood: Possible to Probable. The DPC inquiry IN-22-11-3 specifically concerns the category of transfer at issue in this DPIA. The DPC has demonstrated a willingness to take enforcement action in relation to international transfers, as evidenced by its landmark decisions in the Adriatic Enterprises Ireland (Case IN-20-5-2) matter and other transfer-related enforcement actions. The ICO's prior enforcement action against NTP, while concerning a different processing activity, establishes a pattern of regulatory attention to NTP's data protection practices. The likelihood of some form of regulatory outcome — whether an enforcement notice, a compliance order, or a requirement to implement additional safeguards — is assessed as Possible to Probable.
Severity: Severe. The potential consequences of enforcement action are severe. Under Article 83 of the UK GDPR and the EU GDPR, administrative fines may be imposed of up to the higher of €20 million (£17.5 million under UK GDPR) or 4% of total annual worldwide turnover. For NTP, based on its FY 2022 revenue of approximately £2.47 billion, a fine of up to 4% of annual global turnover would amount to approximately £98.8 million. Beyond financial penalties, the DPC or ICO could issue an order to suspend or prohibit the transfer, which would have immediate and severe operational consequences for NTP's network analytics programme. The reputational damage associated with a high-profile enforcement action would also be significant.
Assessment: The risk is assessed as High (Possible to Probable likelihood, Severe severity). This risk is a primary driver of the overall HIGH risk classification assigned to this processing activity and underscores the importance of implementing and maintaining comprehensive supplementary measures.
4.9 Risk Summary Matrix
The following table summarises the seven identified risks with their pre-mitigation and post-mitigation assessments:
Overall Pre-Mitigation Risk Level: HIGH
Overall Post-Mitigation Risk Level: MODERATE
5. Measures to Mitigate Risks (Supplementary Measures and Safeguards)
5.1 Contractual Measures
The following contractual measures have been implemented or are being implemented to mitigate the identified risks:
EU Standard Contractual Clauses (Module 2: Controller to Processor). EU SCCs were executed on 17 July 2023 between NTP (as data exporter and controller) and Caldwell (as data importer and processor) in accordance with the European Commission's Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries. Module 2 (Controller to Processor) was selected to reflect the parties' respective roles. The executed SCCs incorporate the following key protections: