Stored in a van on the street: A company that stole prisoners' data is fined.

BarcelonaThe Catalan Data Protection Authority (APDCAT) has fined Clece Seguridad €96,004 for failing to take sufficient measures to protect critical information about the prison system that it processes on behalf of the Department of Justice. Specifically, this company provides remote monitoring, tracking, and surveillance services for prisoners on probation who wear a telematic bracelet that geolocates them. Documents regarding the installation of these bracelets were stolen from the company in August 2022, when the papers spent an entire night in a van in a sand parking lot. The company reported the theft the next day but did not alert the department of the information theft.

In fact, the Justice Department didn't find out about the case until November, three months later. And it wasn't because Clece Seguridad informed them, but because the Catalan police (Mossos d'Esquadra) did. As the APDCAT file reviewed by ARA shows, the police recovered the documents during a routine police operation. There was physical documentation of the installation of the GPS bracelets, including the inmate's full name, ID number, and handwritten signature, as well as the location where the bracelet was placed and the prison where it was taken. The Mossos d'Esquadra also recovered two electronic tracking bracelets without any personal data recorded.

Following the Mossos d'Esquadra's notification, the department began an internal investigation. According to the company's statement to the APDCAT (National Police Department), the day after reporting the theft, they received a call from the Premià de Dalt Local Police informing them that the stolen goods had been recovered, so the company "considered the matter closed."

Two violations

Clece Seguridad continues to provide this service for the Justice Department and maintains the same contract it had at the time of the theft. Sources from the department consulted by ARA maintain that the incident "was not due to mismanagement" by the company, but rather because "an employee acted badly." They are referring to the Clece Seguridad technician who, on August 15, 2022, removed two wristbands and the installation sheets from the company in order to perform the equipment replacement and removal service the following day. The worker left the material inside his van overnight, in a public, unguarded parking lot, and went home. The next day at 9:00 a.m., when he returned to the van, he confirmed the theft and reported it.

For all these reasons, the APDCAT (National Criminal Investigation Agency) has sanctioned the company for two violations of the law on the protection of personal data processed for the purposes of prevention, detection, investigation, and prosecution of criminal offenses and the execution of criminal sanctions. One violation is due to the lack of technical and organizational measures to protect data, and the other is for failure to comply with the stipulations set out in the contract, which included the obligation to report any data security breach within 24 hours. Both fines total €96,004, and the company has already paid them.