I'm working on an Android application with a "ban-system". The customer suggested using devices' IMEI/MEID as identifier and asked me about legal issues about that.

Is it legal to store/send user's device IMEI/MEID, or is there any reliable source where I can find legal specifications about it?

Note: This application will be used for a control-access in Spain, but with worldwide devices. I mean, people using it could come from any country