Risk
3/1/2012
04:28 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Insists Privacy Change Is Legal

Data protection authorities claim Google's privacy policy consolidation violates EU law.

Mobile World Congress Preview: 10 Hot Devices
Mobile World Congress Preview: 10 Hot Devices
(click image for larger view and for slideshow)
Google has consolidated its privacy policies, as it said it would, despite the concerns of regulators in the U.S., Europe, and Asia.

Alma Whitten, Google director of privacy, product and engineering, said in a blog post that the consolidation effort makes it easier to understand the company's privacy policy, enables a better experience for signed-in Google users, and leaves existing privacy controls intact.

Although EU Justice Commissioner Viviane Reding told the BBC that Google's privacy policy consolidation violates data protection laws, Google maintains that its changes are legally compliant.

"We are confident that our new simple, clear and transparent privacy policy respects all European data protection laws and principles," a company spokesperson said in an email. "It provides all the information required in Articles 10 & 11 of the directive, plus much additional information, and it follows the guidelines published by the Article 29 Working Party in 2004."

[ Worried about what Google is doing? Read Google Privacy Changes: 6 Steps To Take. ]

NYU Stern School of Business professor Arun Sundararajan says Google is moving in the right direction, but hasn't yet done enough to protect consumers.

"On the one hand, I do give Google credit for providing a greater level of transparency about what information they have about their consumers," Sundararajan said in a phone interview. "What Google isn't doing enough of is telling us what they're going to do with this information. That's a little troubling to me. The policy doesn't say enough about what limits Google will place on this information for advertising purposes. And beyond one small assurance they've given us [about not sharing personal information], we don't know how much they're going to share with marketing partners."

Sundararajan says he doesn't see Google's privacy policy consolidation as altering the privacy risks consumers face. "I see it as a move where Google is reducing its own risk. But I'd like to see them be more forthright in spelling out what they will and won't do with customer data."

Sundararajan suggests that Google's distinction between "personally identifiable information" and "non-personally identifiable information" is outdated, given the extent to which non-personally identifiable data can be correlated to identify someone.

"Re-identifying people based on their [anonymized] activity data is not hard and it's getting increasingly easier," he said.

Sundararajan proposes that companies and regulators adopt an "intent-based" approach to privacy as an alternative to burdensome rules that attempt to define permissible privacy practices.

As he sees it, companies should consider the intention of the customer who provided the data as a guideline for how the customer's data can be used. If a customer signs up for an online service with an email address, for example, the company should be able to use that address to contact the customer about the service but not to identify the customer for an activity profile or some other purpose.

"If companies start to align the way they use their data with the intent the customer had when providing the information, this will go a long way toward mitigating the privacy risk," he said. "There are good-intentioned firms out there that just don't have good guidelines about how to responsibly manage consumer data."

Find out how to move beyond server virtualization to build a more flexible, efficient data center in the new Private Cloud Blueprint issue of Network Computing. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MyW0r1d
50%
50%
MyW0r1d,
User Rank: Apprentice
3/2/2012 | 5:15:15 PM
re: Google Insists Privacy Change Is Legal
I understand and share much of what Sundararajan states with regard to outdated PII definitions and concerns about Google's scope of use. I also have to side with the EU Justice commissioner when it comes to interpreting EU compliance.
What perhaps should disturb us most about the issue in general is the increasingly large number of commercial firms using web traffic and purchasing trends to create profiles for targetted advertising (to name one of the many, read the Target initiative to send congratulations packets to prospective new mothers even before they know or announce to their parents, embarrassing for some teens). All based on data mining and BI of purchases and interests they mail packets to your residence with the discount offers. Prices are falling for 3rd party providers who can offer this questionable use of information as a service to even the most modest of commercial frms. I say questionable because it is not clear how many knowledgably give consent to this use. So why target Google for a trend far more dispersed than you might realize. Orwell may have purposely misidentified BB in his novel.
I believe the US is behind the curve on identifying, defining, and regulating this issue, but it should be fought full court not simply against the biggest player. Your right of free choice is being supplanted by subliminal sale's tactics which leads you to purchase the product they desire.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5211
Published: 2015-01-27
Stack-based buffer overflow in the Attachmate Reflection FTP Client before 14.1.433 allows remote FTP servers to execute arbitrary code via a large PWD response.

CVE-2014-8154
Published: 2015-01-27
The Gst.MapInfo function in Vala 0.26.0 and 0.26.1 uses an incorrect buffer length declaration for the Gstreamer bindings, which allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, which trigger a heap-based buffer overf...

CVE-2014-9197
Published: 2015-01-27
The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware before 1.60 IR 04 stores rde.jar under the web root with insufficient access control, which allows remote attackers to obtain sensitive setup and configuration information via a direct request.

CVE-2014-9198
Published: 2015-01-27
The FTP server on the Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware through 1.60 IR 04 has hardcoded credentials, which makes it easier for remote attackers to obtain access via an FTP session.

CVE-2014-9646
Published: 2015-01-27
Unquoted Windows search path vulnerability in the GoogleChromeDistribution::DoPostUninstallOperations function in installer/util/google_chrome_distribution.cc in the uninstall-survey feature in Google Chrome before 40.0.2214.91 allows local users to gain privileges via a Trojan horse program in the ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.