Google Facing Worldwide Scrutiny Over Street View and Other Products
Ashok Chandra | Bloomberg Law
Google, Inc. is best known as an Internet search company. However, it has spent considerable time and effort developing other products that have both revolutionized technology and, at the same time, raised novel privacy concerns around the world. Google iniatives, such as its integration of its e-mail service into a new social networking platform and its worldwide mapping initiative, have caught the attention of the regulatory agencies in the United States as well as foreign governments. As a result of these investigations, Google has faced fines or the prospect of being barred from collecting data.
Social Network Revealed User Contacts
Google unveiled its first attempt to break into the social-networking business with its Google Buzz platform in February 2010. Google Buzz allowed users to share photographs and make comments, but it also automatically pulled contacts from Gmail accounts and displayed those contacts to other individuals. This immediately raised concerns among consumers, the government and privacy advocacy groups.
In April 2010, Google, Inc. received a demand from the data-protection authorities of 10 countries, including Canada, France, Germany, Israel, Italy, Ireland, the Netherlands, New Zealand, Spain, and the United Kingdom, requesting Google improve its user privacy, specifically referring to Google Buzz.1 In a letter, the U.K. Information Commissioner wrote about Buzz, “In essence, you took Google Mail, a private, one-to-one Web-based e-mail service, and converted it into a social networking service.”2
In the United States, Google settled claims with Federal Trade Commission that it violated its own privacy policies when it introduced Buzz.3 Pursuant to the terms of the settlement, Google must accurately represent how it uses information and it must follow its policies to protect consumer data with regard to any products it releases. Additionally, pursuant to the settlement, although Google would not be subject to fines, it must submit to reviews over a 20 year period to ensure that it is following its privacy policies. Google further agreed to an independent review every two years, and it agreed to give “affirmative consent before [it] change[s] how [it] share[s] [users'] personal information.”4
Google’s Collection of Street View Data Prompts Investigations
Google announced the launch of Street View on May 29, 2007.5 Google Street View is an initiative taken by Google to enhance its existing two dimensional maps into a more immersive and useful depiction of city streets. In order to facilitate mapping, Google equipped cars with cameras and antennas to take photos of streets and houses, which would later be updated in Street View. The photos were pieced together online to create a map that a person on a street would see.
Soon after Street View’s launch, regulatory agencies in different countries began to raise concerns on issues such as the visibility of individual faces in photos, the intrusiveness of the Google cars, and the height of the cameras. Officials from 30 European countries encouraged Google to take preventative steps to protect privacy rights. Among the measures, EU officials recommended that Google improve its blurring technique and consider tweaking images where people’s faces or license plates can be seen.6 In September 2007, the Canadian Privacy Commissioner issued a statement voicing concerns that Google’s practices may affect individual privacy rights of Canadian citizens.7 By May 2009, privacy concerns raised by Street View caused the Hellenic Data Protection Authority to prevent Google from expanding Street View into Greece until Google could provide more information regarding their practices.8 In November 2009, the Federal Data Protection and Information Commissioner (“FDPIC”) of Switzerland announced that as a result of Google’s refusal to implement privacy protections in its Street View services, the FDPIC would be taking the matter to Federal Administrative Court. The FDPIC alleged that Google misrepresented its position, asserting that it would only film in urban centers, but actually filming in rural towns as well.9
In 2010, new allegations arose alleging that Google’s Street View cars collected wireless data from open wireless networks. In May 2010, Peter Schaar, the Federal Commissioner for Data Protection and Freedom of Information in Germany released a statement indicating that the agency had learned that “Google Street View vehicles also were equipped with scanners for WLAN networks.”10 Soon after the allegations arose, the Hamburg Prosecutors’ Office began to investigate individuals at Google for criminal data capture.11 As a result, Google conducted an investigation and admitted to collecting Wi-Fi information sent over wireless networks while collecting data for Street View.12 Google noted that the information collected included web addresses and snippets of e-mails. Upon discovery of the data collection, Google claims it stopped its Street View cars.13
In May 2010, following Google’s announcement that it was collecting Wi-Fi data, Spain, Italy, and France began investigations into Google’s data collection practices.14 At the same time, Google agreed to delete any data it allegedly accidentally collected in Ireland and agreed to do the same in other countries. By June 2010, Google agreed to turn over its Wi-Fi data to regulators in Germany, France, and Spain.15 Soon after, Hungary and Austria began investigations into Google’s data collection procedures. Regulators in Canada and the Czech Republic soon after began investigations. Google stopped deploying its cars for a period of time, but by July 2010, the vehicles were back on the road in Ireland, Norway, South Africa, and Sweden, with Google guaranteeing that it would no longer collect wireless data.16
As a result of the investigations, several countries including Spain, Canada, the United Kingdom, and New Zealand found that Google broke each country’s respective laws by collecting the wireless data. In March 2011, Google was fined 100,000 euros ($142,000) by the French National Commission for Computing and Civil Liberties (“CNIL”), the largest fine in the history of the CNIL.17 The CNIL found that Google violated French privacy rules when it collected passwords and e-mails for Street View, and it determined that a high fine was appropriate because of “the economic advantages Google gained from these violations.”18 However, in the United Kingdom, Britain’s Information Commissioner Christopher Graham indicated that Google has taken “reasonable steps” to improve its privacy policies.19
Google faced scrutiny in Asia as well resulting from its Street View project. South Korean police raided Google’s office in Seoul in August 2010 and collected material from Google associated with the Street View service.20 Although South Korea initiated an investigation, Hong Kong refrained from doing so, indicating that an investigation was unnecessary because none of the date collected by Google was “meaningful.”21 Numerous complaints were also received from cities in Japan, noting that Google’s cameras were too high and could take images over walls into private areas.22 After receiving a letter from Indian police in July 2011, Google stopped operating its Street View cars in India.23
Street View in the United States
In May 2010, as the number of investigations began to increase in Europe, in the United States the FTC announced that it would closely review Google’s data collection policies.24 However, after a summer of investigation, on October 27, 2010, the FTC ended its probe into Google’s collection of unsecured wireless data after Google assured the FTC that it would implement safeguards, improve its privacy standards, and not use the data it collected.25
In November 2010, the Federal Communications Commission announced that it would be investigating Google’s allegedly inadvertent wireless data collection to determine if any of Google’s actions ran afoul of FCC policy.26 The investigation is ongoing, and Chairman Julius Genachowski on June 22, 2011 indicated in letters to several congressmen that “the Bureau’s inquiry seeks to determine whether Google’s actions were inconsistent with any rule or law within the Commission’s jurisdiction,” indicating that the probe is going forward.27
Beyond regulatory action, private citizens affected by Google Street View have also taken their grievances to court. Most recently, in a July 18, 2011 Order, the U.S. District Court for the Northern District stayed litigation and certified for Interlocutory Appeal to the U.S. Court of Appeals for the Ninth Circuit the question of whether a “radio communication” equated with an “electronic communication” under the Wiretap Act.28
Another service, Google Analytics, provides a variety of statistics about visitors to websites. Google Analytics provides information including visitors from referrers, search engines, and other relevant data. However, the manner in which Google collects the data, by tracking IP addresses, has raised privacy concerns. Google Analytics has been shut down in Germany after German officials with the data privacy bureau in Hamburg threatened to fine Google for tracking IP addresses.29 Companies that continued to use Google Analytics in Germany would face a fine.
Android Location Tracking
Google’s smart phone platform, Android, and associated hardware have become the new focus of investigations Germany and France.30 In a nonbinding opinion published on May 18, 2011, EU privacy officials issued a statement indicating that phones running Android could not track the location of the hardware because such information is personal under European data protection laws.31 The opinion stated that users of Android and other similar platforms must be given information about how their data is being processed. The opinion indicated that any data collected through WiFi access points in conjunction with a mobile device’s location constitute personal data and would be subject to privacy rules under the EU.
Future Google Products
As a result of the close scrutiny that Google has faced recently, Google will likely take more precautions before launching new products both domestically and abroad. For example, until 2013, Google has agreed to consult with Australia’s privacy regulator prior to releasing any noteworthy new products in the country.32 As a measure to ensure that it complies with government requests, in April 2010 Google introduced a “transparency tool,” which provides information about “requests it receives for user data or content removal from government agencies.”33 Regardless of what the product is, regulatory agencies around the world will likely look very closely at any initiative put forth by Google before allowing the company to collect data.
This document and any discussions set forth herein are for informational purposes only, and should not be construed as legal advice, which has to be addressed to particular facts and circumstances involved in any given situation. Review or use of the document and any discussions does not create an attorney-client relationship with the author or publisher. To the extent that this document may contain suggested provisions, they will require modification to suit a particular transaction, jurisdiction or situation. Please consult with an attorney with the appropriate level of experience if you have any questions. Any tax information contained in the document or discussions is not intended to be used, and cannot be used, for purposes of avoiding penalties imposed under the United States Internal Revenue Code. Any opinions expressed are those of the author. Bloomberg Finance L.P. and its affiliated entities do not take responsibility for the content in this document or discussions and do not make any representation or warranty as to their completeness or accuracy.
©2011 Bloomberg Finance L.P. All rights reserved. Bloomberg Law Reports ® is a registered trademark and service mark of Bloomberg Finance L.P.