Risk
3/1/2012
04:28 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Google Insists Privacy Change Is Legal

Data protection authorities claim Google's privacy policy consolidation violates EU law.

Mobile World Congress Preview: 10 Hot Devices
Mobile World Congress Preview: 10 Hot Devices
(click image for larger view and for slideshow)
Google has consolidated its privacy policies, as it said it would, despite the concerns of regulators in the U.S., Europe, and Asia.

Alma Whitten, Google director of privacy, product and engineering, said in a blog post that the consolidation effort makes it easier to understand the company's privacy policy, enables a better experience for signed-in Google users, and leaves existing privacy controls intact.

Although EU Justice Commissioner Viviane Reding told the BBC that Google's privacy policy consolidation violates data protection laws, Google maintains that its changes are legally compliant.

"We are confident that our new simple, clear and transparent privacy policy respects all European data protection laws and principles," a company spokesperson said in an email. "It provides all the information required in Articles 10 & 11 of the directive, plus much additional information, and it follows the guidelines published by the Article 29 Working Party in 2004."

[ Worried about what Google is doing? Read Google Privacy Changes: 6 Steps To Take. ]

NYU Stern School of Business professor Arun Sundararajan says Google is moving in the right direction, but hasn't yet done enough to protect consumers.

"On the one hand, I do give Google credit for providing a greater level of transparency about what information they have about their consumers," Sundararajan said in a phone interview. "What Google isn't doing enough of is telling us what they're going to do with this information. That's a little troubling to me. The policy doesn't say enough about what limits Google will place on this information for advertising purposes. And beyond one small assurance they've given us [about not sharing personal information], we don't know how much they're going to share with marketing partners."

Sundararajan says he doesn't see Google's privacy policy consolidation as altering the privacy risks consumers face. "I see it as a move where Google is reducing its own risk. But I'd like to see them be more forthright in spelling out what they will and won't do with customer data."

Sundararajan suggests that Google's distinction between "personally identifiable information" and "non-personally identifiable information" is outdated, given the extent to which non-personally identifiable data can be correlated to identify someone.

"Re-identifying people based on their [anonymized] activity data is not hard and it's getting increasingly easier," he said.

Sundararajan proposes that companies and regulators adopt an "intent-based" approach to privacy as an alternative to burdensome rules that attempt to define permissible privacy practices.

As he sees it, companies should consider the intention of the customer who provided the data as a guideline for how the customer's data can be used. If a customer signs up for an online service with an email address, for example, the company should be able to use that address to contact the customer about the service but not to identify the customer for an activity profile or some other purpose.

"If companies start to align the way they use their data with the intent the customer had when providing the information, this will go a long way toward mitigating the privacy risk," he said. "There are good-intentioned firms out there that just don't have good guidelines about how to responsibly manage consumer data."

Find out how to move beyond server virtualization to build a more flexible, efficient data center in the new Private Cloud Blueprint issue of Network Computing. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
MyW0r1d
50%
50%
MyW0r1d,
User Rank: Apprentice
3/2/2012 | 5:15:15 PM
re: Google Insists Privacy Change Is Legal
I understand and share much of what Sundararajan states with regard to outdated PII definitions and concerns about Google's scope of use. I also have to side with the EU Justice commissioner when it comes to interpreting EU compliance.
What perhaps should disturb us most about the issue in general is the increasingly large number of commercial firms using web traffic and purchasing trends to create profiles for targetted advertising (to name one of the many, read the Target initiative to send congratulations packets to prospective new mothers even before they know or announce to their parents, embarrassing for some teens). All based on data mining and BI of purchases and interests they mail packets to your residence with the discount offers. Prices are falling for 3rd party providers who can offer this questionable use of information as a service to even the most modest of commercial frms. I say questionable because it is not clear how many knowledgably give consent to this use. So why target Google for a trend far more dispersed than you might realize. Orwell may have purposely misidentified BB in his novel.
I believe the US is behind the curve on identifying, defining, and regulating this issue, but it should be fought full court not simply against the biggest player. Your right of free choice is being supplanted by subliminal sale's tactics which leads you to purchase the product they desire.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5316
Published: 2014-09-21
Cross-site scripting (XSS) vulnerability in Dotclear before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a crafted page.

CVE-2014-5320
Published: 2014-09-21
The Bump application for Android does not properly handle implicit intents, which allows attackers to obtain sensitive owner-name information via a crafted application.

CVE-2014-5321
Published: 2014-09-21
FileMaker Pro before 13 and Pro Advanced before 13 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2319...

CVE-2014-5322
Published: 2014-09-21
Cross-site scripting (XSS) vulnerability in the Instant Web Publish function in FileMaker Pro before 13 and Pro Advanced before 13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-3640.

CVE-2014-6602
Published: 2014-09-21
Microsoft Asha OS on the Microsoft Mobile Nokia Asha 501 phone 14.0.4 allows physically proximate attackers to bypass the lock-screen protection mechanism, and read or modify contact information or dial arbitrary telephone numbers, by tapping the SOS Option and then tapping the Green Call Option.

Best of the Web
Dark Reading Radio