Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite
1

I'm working on an Android application with a "ban-system". The customer suggested using devices' IMEI/MEID as identifier and asked me about legal issues about that.

Is it legal to store/send user's device IMEI/MEID, or is there any reliable source where I can find legal specifications about it?

Note: This application will be used for a control-access in Spain, but with worldwide devices. I mean, people using it could come from any country

share|improve this question
What country are you in? What data do you store along with the IMEI? Is it anything that can be used to identify the individual? – Polynomial Nov 16 '12 at 11:15
This application will be used for a control-access in Spain, but with worldwide devices. I mean, people using it could come from any country – Christian García Nov 16 '12 at 11:18
1  
Storage and handling laws generally apply to the country in which the provider is. – Polynomial Nov 16 '12 at 11:19
There is an inherent contradiction in your question. "legal" is by definition country specific, but you're asking about the world. Please consult a lawyer, not stack exchange. – Mark C. Wallace Nov 16 '12 at 11:55

closed as off topic by Iszi, Rory Alsop♦ Nov 16 '12 at 17:54

Questions on IT Security Stack Exchange are expected to relate to IT security within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

2 Answers

up vote 6 down vote accepted

As this is a legal question, the usual IANAL disclaimer applies.

In the UK, at least, it is completely legal to store the IMEI number of a mobile device. I can't imagine it being any different for Spain, because an IMEI isn't personal data, it's a device serial number. However, you may come under scrutiny if you later have a breach that leaks the IMEI number attached to personal data (e.g. name, address) because that data would allow an attacker to sniff cell traffic and discover that a person is within the cell tower's range.

If you're just implementing a banning system, why not hash the IMEI with a cryptographic hash algorithm such as SHA1? It doesn't need salting, since the keyspace is large enough to prevent dictionary attacks anyway. That way, if a breach does occur, the IMEIs are computationally difficult to discover.

share|improve this answer
Very useful, and this about applying hash system is just perfect for my case. Thanks! – Christian García Nov 16 '12 at 11:29
up vote 0 down vote

Under Article 2 EU Data Protection Directive it defines that personal data;

shall mean any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;

It also states that;

'processing of personal data' ('processing') shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

But under Article 7 it states that;

Member States shall provide that personal data may be processed only if:

(a) the data subject has unambiguously given his consent; ...

So from what I understand of this, you should be ok so long as you have a legal notices or terms and conditions of using the app stating that you will be storing this information.

This directive is also being extended so that US companies may also process your user information in the future. Extended EU Directive

share|improve this answer
1  
It's difficult to tell whether this applies. An IMEI isn't personal data - it's a device serial number. Technically one might say that you are identifiable via it, but that's only the case if you have access to phone registration records. – Polynomial Nov 16 '12 at 15:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.