Risk
3/1/2012
04:28 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Insists Privacy Change Is Legal

Data protection authorities claim Google's privacy policy consolidation violates EU law.

Mobile World Congress Preview: 10 Hot Devices
Mobile World Congress Preview: 10 Hot Devices
(click image for larger view and for slideshow)
Google has consolidated its privacy policies, as it said it would, despite the concerns of regulators in the U.S., Europe, and Asia.

Alma Whitten, Google director of privacy, product and engineering, said in a blog post that the consolidation effort makes it easier to understand the company's privacy policy, enables a better experience for signed-in Google users, and leaves existing privacy controls intact.

Although EU Justice Commissioner Viviane Reding told the BBC that Google's privacy policy consolidation violates data protection laws, Google maintains that its changes are legally compliant.

"We are confident that our new simple, clear and transparent privacy policy respects all European data protection laws and principles," a company spokesperson said in an email. "It provides all the information required in Articles 10 & 11 of the directive, plus much additional information, and it follows the guidelines published by the Article 29 Working Party in 2004."

[ Worried about what Google is doing? Read Google Privacy Changes: 6 Steps To Take. ]

NYU Stern School of Business professor Arun Sundararajan says Google is moving in the right direction, but hasn't yet done enough to protect consumers.

"On the one hand, I do give Google credit for providing a greater level of transparency about what information they have about their consumers," Sundararajan said in a phone interview. "What Google isn't doing enough of is telling us what they're going to do with this information. That's a little troubling to me. The policy doesn't say enough about what limits Google will place on this information for advertising purposes. And beyond one small assurance they've given us [about not sharing personal information], we don't know how much they're going to share with marketing partners."

Sundararajan says he doesn't see Google's privacy policy consolidation as altering the privacy risks consumers face. "I see it as a move where Google is reducing its own risk. But I'd like to see them be more forthright in spelling out what they will and won't do with customer data."

Sundararajan suggests that Google's distinction between "personally identifiable information" and "non-personally identifiable information" is outdated, given the extent to which non-personally identifiable data can be correlated to identify someone.

"Re-identifying people based on their [anonymized] activity data is not hard and it's getting increasingly easier," he said.

Sundararajan proposes that companies and regulators adopt an "intent-based" approach to privacy as an alternative to burdensome rules that attempt to define permissible privacy practices.

As he sees it, companies should consider the intention of the customer who provided the data as a guideline for how the customer's data can be used. If a customer signs up for an online service with an email address, for example, the company should be able to use that address to contact the customer about the service but not to identify the customer for an activity profile or some other purpose.

"If companies start to align the way they use their data with the intent the customer had when providing the information, this will go a long way toward mitigating the privacy risk," he said. "There are good-intentioned firms out there that just don't have good guidelines about how to responsibly manage consumer data."

Find out how to move beyond server virtualization to build a more flexible, efficient data center in the new Private Cloud Blueprint issue of Network Computing. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MyW0r1d
50%
50%
MyW0r1d,
User Rank: Apprentice
3/2/2012 | 5:15:15 PM
re: Google Insists Privacy Change Is Legal
I understand and share much of what Sundararajan states with regard to outdated PII definitions and concerns about Google's scope of use. I also have to side with the EU Justice commissioner when it comes to interpreting EU compliance.
What perhaps should disturb us most about the issue in general is the increasingly large number of commercial firms using web traffic and purchasing trends to create profiles for targetted advertising (to name one of the many, read the Target initiative to send congratulations packets to prospective new mothers even before they know or announce to their parents, embarrassing for some teens). All based on data mining and BI of purchases and interests they mail packets to your residence with the discount offers. Prices are falling for 3rd party providers who can offer this questionable use of information as a service to even the most modest of commercial frms. I say questionable because it is not clear how many knowledgably give consent to this use. So why target Google for a trend far more dispersed than you might realize. Orwell may have purposely misidentified BB in his novel.
I believe the US is behind the curve on identifying, defining, and regulating this issue, but it should be fought full court not simply against the biggest player. Your right of free choice is being supplanted by subliminal sale's tactics which leads you to purchase the product they desire.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.