[ Worried about what Google is doing? Read Google Privacy Changes: 6 Steps To Take. ]
NYU Stern School of Business professor Arun Sundararajan says Google is moving in the right direction, but hasn't yet done enough to protect consumers.
"On the one hand, I do give Google credit for providing a greater level of transparency about what information they have about their consumers," Sundararajan said in a phone interview. "What Google isn't doing enough of is telling us what they're going to do with this information. That's a little troubling to me. The policy doesn't say enough about what limits Google will place on this information for advertising purposes. And beyond one small assurance they've given us [about not sharing personal information], we don't know how much they're going to share with marketing partners."
Sundararajan suggests that Google's distinction between "personally identifiable information" and "non-personally identifiable information" is outdated, given the extent to which non-personally identifiable data can be correlated to identify someone.
"Re-identifying people based on their [anonymized] activity data is not hard and it's getting increasingly easier," he said.
Sundararajan proposes that companies and regulators adopt an "intent-based" approach to privacy as an alternative to burdensome rules that attempt to define permissible privacy practices.
As he sees it, companies should consider the intention of the customer who provided the data as a guideline for how the customer's data can be used. If a customer signs up for an online service with an email address, for example, the company should be able to use that address to contact the customer about the service but not to identify the customer for an activity profile or some other purpose.
"If companies start to align the way they use their data with the intent the customer had when providing the information, this will go a long way toward mitigating the privacy risk," he said. "There are good-intentioned firms out there that just don't have good guidelines about how to responsibly manage consumer data."
Find out how to move beyond server virtualization to build a more flexible, efficient data center in the new Private Cloud Blueprint issue of Network Computing. (Free registration required.)