This article is also available in:
Deutsch: Spanische Datenschutzbehörde leitet Verfahren gegen Google Street Vie...
The Spanish Data Protection Agency (AEPD) has opened an infringement proceeding against Google after completing the preliminary inspection activities which started in May on the collection and storage without consent of Wi-Fi networks location data and traffic data associated with them (payload) by the vehicles used to photograph streets of several Spanish cities, for the company's Street View application.
Moreover, once the infringement proceeding has been initiated, the AEPD has forwarded to the court the final inspection report, and according to the Administrative Procedure law, has adjourned the proceedings, pending the outcome of criminal proceedings in which the company is involved in the Court of Instruction No. 45 of Madrid.
The opening of an infringement proceeding by the Spanish Data Protection Agency follows the conclusion of the investigations carried out by the AEPD's inspection, which have revealed the presence of signs of a total of five violations -two serious and three very serious- of the Spanish Data Protection Act. Two of them are attributable to Google in its capacity as responsible for providing the service and designing the software that collects data for the Street View service. The other three are attributable to Google Spain, as Google representatives in Spain are responsible for collecting and storing the data in Spain and for transferring it to the United States.
Specifically, the investigations carried out by the Spanish DPA have verified the collection and storage by Google vehicles of personal data of various types transmitted through open Wi-Fi networks. Between the typology of personal data transmitted through these Wi- Fi networks, the AEPD has established the collection and storage by Google of email addresses, with names and surnames, addresses associated with email messages or instant messaging, access to social network accounts and websites or user names and passwords with personal data identifying its owners and, in some cases, allowing access to special sensitive data, among others.
Furthermore, the investigation established the collection by Google of location and identification data of wireless networks, such as SSID, identifiers or names of the Wi-Fi network, that in some cases, contains the real name of the subscriber, and the MAC addresses- that identify the router, connected devices and the geographic position in which they were collected.
In addition, it has been established the international transfer of personal data by Google to United States, without demonstrating the compliance of the guarantees provided by the Data Protection Act that authorizes the international transfers.
In this regard, the decision starting the infringement proceedings charges both Google Spain and Google Inc with the commission of serious violations of the Organic Act 15/1999 - subject to fines from 60 000 euro to 300 000 euro each - due to the processing of personal data without the consent of the data subject, as well as very serious violations of collecting and processing of personal data with special protection or without the explicit consent of the data subject, as stated by the Data Protection Act.
Also, Google Spain is charged with another very serious violation of the Organic Law because of the international transfer of data to the United States of America without the guarantees foreseen by the Data Protection Act.
By virtue of section 7 of the Royal Decree 1398/1993, the Spanish Data Protection Agency had to adjourn the administrative proceedings because of the criminal proceedings started by the First-instance Court number 45 of Madrid.
Once the criminal proceedings are finalised, the Spanish Data Protection Agency will resume the administrative proceedings in accordance with the legal procedural rules, In that sense, the affected entities will have a term for bringing pleadings or evidence, before the final resolution of the Authority deciding on the infringements and on their legal categorisation is determined.
Press release in Spanish (18.10.2010)
https://www.agpd.es/portalwebAGPD/revista_prensa/revista_prensa/2010/n...
(Thanks to Spanish DPA Press Release)