Risk
3/1/2012
04:28 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Google Insists Privacy Change Is Legal

Data protection authorities claim Google's privacy policy consolidation violates EU law.

Mobile World Congress Preview: 10 Hot Devices
Mobile World Congress Preview: 10 Hot Devices
(click image for larger view and for slideshow)
Google has consolidated its privacy policies, as it said it would, despite the concerns of regulators in the U.S., Europe, and Asia.

Alma Whitten, Google director of privacy, product and engineering, said in a blog post that the consolidation effort makes it easier to understand the company's privacy policy, enables a better experience for signed-in Google users, and leaves existing privacy controls intact.

Although EU Justice Commissioner Viviane Reding told the BBC that Google's privacy policy consolidation violates data protection laws, Google maintains that its changes are legally compliant.

"We are confident that our new simple, clear and transparent privacy policy respects all European data protection laws and principles," a company spokesperson said in an email. "It provides all the information required in Articles 10 & 11 of the directive, plus much additional information, and it follows the guidelines published by the Article 29 Working Party in 2004."

[ Worried about what Google is doing? Read Google Privacy Changes: 6 Steps To Take. ]

NYU Stern School of Business professor Arun Sundararajan says Google is moving in the right direction, but hasn't yet done enough to protect consumers.

"On the one hand, I do give Google credit for providing a greater level of transparency about what information they have about their consumers," Sundararajan said in a phone interview. "What Google isn't doing enough of is telling us what they're going to do with this information. That's a little troubling to me. The policy doesn't say enough about what limits Google will place on this information for advertising purposes. And beyond one small assurance they've given us [about not sharing personal information], we don't know how much they're going to share with marketing partners."

Sundararajan says he doesn't see Google's privacy policy consolidation as altering the privacy risks consumers face. "I see it as a move where Google is reducing its own risk. But I'd like to see them be more forthright in spelling out what they will and won't do with customer data."

Sundararajan suggests that Google's distinction between "personally identifiable information" and "non-personally identifiable information" is outdated, given the extent to which non-personally identifiable data can be correlated to identify someone.

"Re-identifying people based on their [anonymized] activity data is not hard and it's getting increasingly easier," he said.

Sundararajan proposes that companies and regulators adopt an "intent-based" approach to privacy as an alternative to burdensome rules that attempt to define permissible privacy practices.

As he sees it, companies should consider the intention of the customer who provided the data as a guideline for how the customer's data can be used. If a customer signs up for an online service with an email address, for example, the company should be able to use that address to contact the customer about the service but not to identify the customer for an activity profile or some other purpose.

"If companies start to align the way they use their data with the intent the customer had when providing the information, this will go a long way toward mitigating the privacy risk," he said. "There are good-intentioned firms out there that just don't have good guidelines about how to responsibly manage consumer data."

Find out how to move beyond server virtualization to build a more flexible, efficient data center in the new Private Cloud Blueprint issue of Network Computing. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MyW0r1d
50%
50%
MyW0r1d,
User Rank: Apprentice
3/2/2012 | 5:15:15 PM
re: Google Insists Privacy Change Is Legal
I understand and share much of what Sundararajan states with regard to outdated PII definitions and concerns about Google's scope of use. I also have to side with the EU Justice commissioner when it comes to interpreting EU compliance.
What perhaps should disturb us most about the issue in general is the increasingly large number of commercial firms using web traffic and purchasing trends to create profiles for targetted advertising (to name one of the many, read the Target initiative to send congratulations packets to prospective new mothers even before they know or announce to their parents, embarrassing for some teens). All based on data mining and BI of purchases and interests they mail packets to your residence with the discount offers. Prices are falling for 3rd party providers who can offer this questionable use of information as a service to even the most modest of commercial frms. I say questionable because it is not clear how many knowledgably give consent to this use. So why target Google for a trend far more dispersed than you might realize. Orwell may have purposely misidentified BB in his novel.
I believe the US is behind the curve on identifying, defining, and regulating this issue, but it should be fought full court not simply against the biggest player. Your right of free choice is being supplanted by subliminal sale's tactics which leads you to purchase the product they desire.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-4988
Published: 2014-07-09
Heap-based buffer overflow in the xjpegls.dll (aka JLS, JPEG-LS, or JPEG lossless) format plugin in XnView 1.99 and 1.99.1 allows remote attackers to execute arbitrary code via a crafted JLS image file.

CVE-2014-0207
Published: 2014-07-09
The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.

CVE-2014-0537
Published: 2014-07-09
Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 allow attackers to bypass intended access restrictions via uns...

CVE-2014-0539
Published: 2014-07-09
Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and before 11.2.202.394 on Linux, Adobe AIR before 14.0.0.137 on Android, Adobe AIR SDK before 14.0.0.137, and Adobe AIR SDK & Compiler before 14.0.0.137 allow attackers to bypass intended access restrictions via uns...

CVE-2014-3309
Published: 2014-07-09
The NTP implementation in Cisco IOS and IOS XE does not properly support use of the access-group command for a "deny all" configuration, which allows remote attackers to bypass intended restrictions on time synchronization via a standard query, aka Bug ID CSCuj66318.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.