Hundreds of devices carried by EU and NATO officials have been tracked to personal and secure locations in Belgium through commercially available phone location data which was obtained by a group of European news outlets.
The specificity of the data raises questions about officials' personal safety, and espionage concerns, according to experts.
The European Commission has described the details as "concerning", and several Irish MEPs have called for action to address the issue.
Analysis of the data, which can be purchased legally from data brokers, showed movements linked to 264 devices inside the European Commission’s Berlaymont headquarters, and a further 543 at NATO headquarters.
In some cases, reporters were then able to track individuals from those buildings back to their residential addresses. These included five EU employees: a senior Commission official, a high-ranking diplomat, as well as staff from the European Parliament and the European External Action Service.
Two of the individuals confirmed that the data accurately reflected their daily movements.
The investigation was jointly conducted by journalists in Germany (from netzpolitik.org and Bayerischer Rundfunk), France (Le Monde), Belgium (L’Echo) and The Netherlands (BNR Newsradio)
Two datasets containing 278 million mobile-phone location pings from Belgium were analysed.
It follows a similar Prime Time investigation broadcast in September which exposed how detailed movement data from Irish phone smartphone users is available to purchase from brokers in the digital advertising and marketing industry.
Read more: Security concern as tens of thousands of phone locations for sale
A team of RTÉ journalists posed as a newly established data analytics agency and obtained a sample of available data which showed the exact movement of 64,000 Irish smartphones over a two-week period.
The data was analysed and showed how phones in Leinster House, prisons, garda stations, military bases, and other secure or sensitive locations, could be identified and then tracked back to residential addresses.
The details exposed in the investigation triggered serious concern at the highest levels of Government and within the Data Protection Commission.
The Irish Data Protection Commission is now investigating the data broker at the centre of the Prime Time story, and several other related companies.
Responding to the new revelations, the European Commission said in a statement it has "issued fresh guidance to its staff on ad-tracking settings on corporate and private devices, as well as informed other Union entities and Computer Security Incident Response Teams (CSIRTs) in Member States."
A NATO spokesperson said the alliance was "fully aware of the general risks that third-party data collection poses to the Alliance" and had taken steps to mitigate them.
Irish MEPs have warned that the latest revelations show the sale of sensitive data must now be viewed as both a privacy and security issue.
In response to queries from Prime Time, Fianna Fáil MEP Billy Kelleher said Europe’s data-protection regime "clearly doesn’t go far enough".
"Consumers and citizens need to be protected. This is more than a privacy issue. Nefarious third countries are actively trying to undermine our Union and our values; we need to see data as a security issue and treat it and those that undermine it in a serious way."
He said "a refinement of existing legislation or possibly a new regulation" was now needed to strengthen enforcement and ensure consumers understand how their data is used.
Fine Gael MEP Maria Walsh, who sits on the European Parliament’s Civil Liberties, Justice and Home Affairs Committee, said the findings showed European laws "are failing to protect European security and our citizens."
"The physical location and home addresses of EU citizens cannot be up for sale. The commodification of our privacy is abhorrent and presents a major threat to European security when people in power are targeted."
She said the EU must now focus on tougher enforcement of existing rules, combined with new laws to tackle emerging threats.
"When diplomats and officials are exposed, it’s not just their safety at risk – it’s Europe’s security....We would be naive to think that Russian and other anti-EU actors are not already exploiting the readily available data against us."
Sinn Féin MEP Lynn Boylan told Prime Time: "I am incredibly concerned by the growth in the trade of personal data, particularly location data. The fact that the location data of senior figures of international institutions such as the European Union is being sold by EU-based data brokers demonstrates a real and dangerous gap in regulation which must be addressed."
"As a member of the European Parliament International Trade Committee, I will be raising this issue as something which requires quick and comprehensive action."
"This case of location data should serve as an important reminder as to why we regulated Big Tech in the first place and rather than embarking on a process of deregulation, the EU needs to ramp up its efforts to reign in the companies especially when they engage in practices like the sale of location data which erode the privacy and civil liberties of EU citizens."
Independent MEP Michael McNamara said this data could potentially amount to a national- and EU-level security risk, "depending on whose data is being traded and why. It certainly amounts to a huge invasion of privacy".
"It is behaviour such as this that EU wide laws such as the GDPR and the EU Data Act seeks, and needs, to preclude rather than ensuring endless cookie warnings," he said.
"The current focus in Brussels is on deregulation rather that further regulation...effective laws that protect the data privacy of EU citizens and their democratic representatives, and effective implementation of those laws, are now more important than ever."
