Spanish DPA opens infringement procedures for Google Streetview

This article is also available in:
Deutsch: [Spanische Datenschutzbehörde leitet Verfahren gegen Google Street View ein | http://www.unwatched.org/node/2282]

The Spanish Data Protection Agency (AEPD) has opened an infringement
proceeding against Google after completing the preliminary inspection
activities which started in May on the collection and storage without
consent of Wi-Fi networks location data and traffic data associated with
them (payload) by the vehicles used to photograph streets of several Spanish
cities, for the company’s Street View application.

Moreover, once the infringement proceeding has been initiated, the AEPD has
forwarded to the court the final inspection report, and according to the
Administrative Procedure law, has adjourned the proceedings, pending the
outcome of criminal proceedings in which the company is involved in the
Court of Instruction No. 45 of Madrid.

The opening of an infringement proceeding by the Spanish Data Protection
Agency follows the conclusion of the investigations carried out by the
AEPD’s inspection, which have revealed the presence of signs of a total of
five violations -two serious and three very serious- of the Spanish Data
Protection Act. Two of them are attributable to Google in its capacity as
responsible for providing the service and designing the software that
collects data for the Street View service. The other three are attributable
to Google Spain, as Google representatives in Spain are responsible for
collecting and storing the data in Spain and for transferring
it to the United States.

Specifically, the investigations carried out by the Spanish
DPA have verified the collection and storage by Google vehicles of
personal data of various types transmitted through open Wi-Fi networks.
Between the typology of personal data transmitted through these Wi- Fi
networks, the AEPD has established the collection and storage by Google of
email addresses, with names and surnames, addresses associated with email
messages or instant messaging, access to social network accounts and
websites or user names and passwords with personal data identifying its
owners and, in some cases, allowing access to special sensitive data, among
others.

Furthermore, the investigation established the collection by Google of
location and identification data of wireless networks, such as SSID,
identifiers or names of the Wi-Fi network, that in some cases, contains the
real name of the subscriber, and the MAC addresses- that identify the
router, connected devices and the geographic position in which they were
collected.

In addition, it has been established the international transfer of personal
data by Google to United States, without demonstrating the compliance of the
guarantees provided by the Data Protection Act that authorizes the
international transfers.

In this regard, the decision starting the infringement proceedings charges
both Google Spain and Google Inc with the commission of serious violations
of the Organic Act 15/1999 – subject to fines from 60 000 euro to 300 000
euro each – due to the processing of personal data without the consent of
the data subject, as well as very serious violations of collecting
and processing of personal data with special protection or without the
explicit consent of the data subject, as stated by the Data Protection Act.

Also, Google Spain is charged with another very serious violation of the
Organic Law because of the international transfer of data to the United
States of America without the guarantees foreseen by the Data Protection
Act.

By virtue of section 7 of the Royal Decree 1398/1993, the Spanish Data
Protection Agency had to adjourn the administrative proceedings because of
the criminal proceedings started by the First-instance Court number 45 of
Madrid.

Once the criminal proceedings are finalised, the Spanish Data Protection
Agency will resume the administrative proceedings in accordance with the
legal procedural rules, In that sense, the affected entities will have a
term for bringing pleadings or evidence, before the final resolution of the
Authority deciding on the infringements and on their legal categorisation is
determined.

Press release in Spanish (18.10.2010)
https://www.agpd.es/portalwebAGPD/revista_prensa/revista_prensa/2010/notas_prensa/common/octubre/101018_np_google.pdf

(Thanks to Spanish DPA Press Release)