An SSID doesn’t do that. It might allow someone in the general vicinity the ability to identify which house the SSID originates from but that still doesnt reveal the identity of the person inside.
Google and/or Apple already has that. They have maps. They know where people live.
And to be clear, it’s not the SSID but rather the MAC address that’s unique enough to make this possible. Although the SSID alone could do it in aggregate with other local SSIDs.
A natural person is “identified or identifiable” if they can be distinguished from others in a given context using means reasonably likely to be used and in a way that makes it possible to treat them differently.
Google often knows who bought the Karcher radio. GAFAM is interested enough in who is buying what that they go as far as buying data from local shops in order to find out who buys what offline.
Does the information relate to a natural person?
Of course, when the radio is owned by a natural person.
Is the natural person identifiable?
They are identifiable to the entity who the SSID & MAC is shared with.
Is it reasonably possible for someone to establish your identity and are they likely to bother trying.
The machinery of surveillance advertisers like Google and Apple is designed to require no effort. They put effort into the infra, but from there the infra automatically identifies and grows profile data for further sales (read: privacy exploits).
Karcher will be selling the fact that the device is WiFi enabled,
Irrelevant. A wi-fi client does not need to broadcast an SSID.
and they will argue that if a broadcast SSID does meet the criteria of personal data it is irrelevant
They will want to avoid talking about MAC addresses for sure.
because you willingly consented to it (or entered into a contract) by buying the product
So you believe the legal basis is “consent” or “contract”? I don’t see how either apply. There is no contract to speak of. The purchase literature is on the box which does not mention SSID broadcasting.
“Consent”-based legal basis requires being informed in the very least, according to the EDPB. And it cannot just be some fine print stashed somewhere. It requires explicit informed consent. They don’t have that. Consumers don’t even necessarily know this broadcast is occurring.
and you can easily withdraw your consent by not using the product anymore.
It must be unplugged. And the data subject must be informed in the first place. Which is the crux of the problem. It’s not art.5 (data minimisation) compliant, and data subjects are not being informed.