Spy van: Fine of € 925.000 to WS WiSpear Systems

The office of the Commissioner for Personal Data Protection imposed a fine of 925.000 euros on the company WS WiSpear Systems for the case of the spy van.

Such is the announcement 

An administrative fine of nine hundred and twenty-five thousand euros (€ 925.000) was collected today by WS WiSpear Systems Ltd following a Decision I issued, for its violation of the Principle of Legality, Objectivity and Transparency established by Article 5 (1) (a) of the General Data Protection Regulation (GPA).

The case concerned the much-praised "van" case. My Office has been working closely with the Police on this case since November 2019 and I had issued a relevant Opinion, to assist the investigation. Upon completion of the criminal investigation, which also took into account the assistance of my Office, the case file was transferred to the Legal Service. After the company was informed of the results of the investigation, it sent a letter to my Office in which it essentially acknowledged its responsibility for the above violation.

For the imposition of the fine, I took into account various aggravating and mitigating factors, such as the company's acknowledgment to my Office and the confirmation I received from the Legal Service that, from the expert investigation, no device monitoring or interception of any private communication was detected.

In my Decision I concluded that, activities of the company, which resulted in the collection of data Mac Address (Media Access Control Address) and IMSI (International Mobile Subscriber Identity) of various devices, in the context of testing and presentation of technologies, which the company carried out at the essential time, without know the users of the devices, constituted a violation of the Principle of Legality, Objectivity and Transparency.

Mac Addresses are unique numbers that a device recognizes when it connects to the Internet. IMSI is a unique number, contained in SIM cards (Subscriber Identity Module) and identifies a subscriber when connected to its provider's network. This data, in combination with the geographical location of a device, at different times, can lead to the identification of the user of the device.

The imposition of an administrative fine does not apply to any criminal liability of the company wanted to be judged.