Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3/1/2012
04:28 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Insists Privacy Change Is Legal

Data protection authorities claim Google's privacy policy consolidation violates EU law.

Mobile World Congress Preview: 10 Hot Devices
Mobile World Congress Preview: 10 Hot Devices
(click image for larger view and for slideshow)
Google has consolidated its privacy policies, as it said it would, despite the concerns of regulators in the U.S., Europe, and Asia.

Alma Whitten, Google director of privacy, product and engineering, said in a blog post that the consolidation effort makes it easier to understand the company's privacy policy, enables a better experience for signed-in Google users, and leaves existing privacy controls intact.

Although EU Justice Commissioner Viviane Reding told the BBC that Google's privacy policy consolidation violates data protection laws, Google maintains that its changes are legally compliant.

"We are confident that our new simple, clear and transparent privacy policy respects all European data protection laws and principles," a company spokesperson said in an email. "It provides all the information required in Articles 10 & 11 of the directive, plus much additional information, and it follows the guidelines published by the Article 29 Working Party in 2004."

[ Worried about what Google is doing? Read Google Privacy Changes: 6 Steps To Take. ]

NYU Stern School of Business professor Arun Sundararajan says Google is moving in the right direction, but hasn't yet done enough to protect consumers.

"On the one hand, I do give Google credit for providing a greater level of transparency about what information they have about their consumers," Sundararajan said in a phone interview. "What Google isn't doing enough of is telling us what they're going to do with this information. That's a little troubling to me. The policy doesn't say enough about what limits Google will place on this information for advertising purposes. And beyond one small assurance they've given us [about not sharing personal information], we don't know how much they're going to share with marketing partners."

Sundararajan says he doesn't see Google's privacy policy consolidation as altering the privacy risks consumers face. "I see it as a move where Google is reducing its own risk. But I'd like to see them be more forthright in spelling out what they will and won't do with customer data."

Sundararajan suggests that Google's distinction between "personally identifiable information" and "non-personally identifiable information" is outdated, given the extent to which non-personally identifiable data can be correlated to identify someone.

"Re-identifying people based on their [anonymized] activity data is not hard and it's getting increasingly easier," he said.

Sundararajan proposes that companies and regulators adopt an "intent-based" approach to privacy as an alternative to burdensome rules that attempt to define permissible privacy practices.

As he sees it, companies should consider the intention of the customer who provided the data as a guideline for how the customer's data can be used. If a customer signs up for an online service with an email address, for example, the company should be able to use that address to contact the customer about the service but not to identify the customer for an activity profile or some other purpose.

"If companies start to align the way they use their data with the intent the customer had when providing the information, this will go a long way toward mitigating the privacy risk," he said. "There are good-intentioned firms out there that just don't have good guidelines about how to responsibly manage consumer data."

Find out how to move beyond server virtualization to build a more flexible, efficient data center in the new Private Cloud Blueprint issue of Network Computing. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MyW0r1d
50%
50%
MyW0r1d,
User Rank: Apprentice
3/2/2012 | 5:15:15 PM
re: Google Insists Privacy Change Is Legal
I understand and share much of what Sundararajan states with regard to outdated PII definitions and concerns about Google's scope of use. I also have to side with the EU Justice commissioner when it comes to interpreting EU compliance.
What perhaps should disturb us most about the issue in general is the increasingly large number of commercial firms using web traffic and purchasing trends to create profiles for targetted advertising (to name one of the many, read the Target initiative to send congratulations packets to prospective new mothers even before they know or announce to their parents, embarrassing for some teens). All based on data mining and BI of purchases and interests they mail packets to your residence with the discount offers. Prices are falling for 3rd party providers who can offer this questionable use of information as a service to even the most modest of commercial frms. I say questionable because it is not clear how many knowledgably give consent to this use. So why target Google for a trend far more dispersed than you might realize. Orwell may have purposely misidentified BB in his novel.
I believe the US is behind the curve on identifying, defining, and regulating this issue, but it should be fought full court not simply against the biggest player. Your right of free choice is being supplanted by subliminal sale's tactics which leads you to purchase the product they desire.
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27132
PUBLISHED: 2021-02-27
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
CVE-2021-25284
PUBLISHED: 2021-02-27
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
CVE-2021-3144
PUBLISHED: 2021-02-27
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
CVE-2021-3148
PUBLISHED: 2021-02-27
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
CVE-2021-3151
PUBLISHED: 2021-02-27
i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CONFIG__TITLE, C__MONITORING__CONFIG__PATH, SM2__C__MONITORING__CONFIG__PATH, C__M...