Google committed a "significant breach" of the Data Protection Act when its Street View cars collected personal data including full emails and passwords from unsuspecting internet users, the UK information commissioner confirmed today.
The information commissioner, Christopher Graham, rejected calls to inflict a financial penalty on Google, but said the company must sign an undertaking to ensure data protection breaches do not happen again or it will face further enforcement action.
Google has also been ordered to delete the data it collected from users'Wi-Fi networks by its Street View cars once legally cleared to do so. The culture minister, Ed Vaizey, last week announced the Metropolitan police had dropped its investigation into the breaches.
Graham said: "It is my view that the collection of this information was not fair or lawful and constitutes a significant breach of the first principle of the Data Protection Act (DPA).
"The most appropriate and proportionate regulatory action in these circumstances is to get written legal assurance from Google that this will not happen again – and to follow this up with an ICO audit."
He added that the technology giant would now be subject to an official audit of its data protection practices in the UK.
Google global privacy counsel, Peter Fleischer, said: "We are profoundly sorry for mistakenly collecting payload data in the UK from unencrypted wireless networks.
"Since we announced our mistake in May we have cooperated closely with the ICO and worked to improve our internal controls. As we have said before, we did not want this data, have never used any of it in our products or services, and have sought to delete it as quickly as possible.
"We are in the process of confirming that there are no outstanding legal obligations upon us to retain the data, and will then ensure that it is quickly and safely deleted."
Privacy campaigners reacted angrily to the ICO's decision not to impose a financial penalty on Google, warning that it could now be open-season for internet businesses to breach users' privacy.
Alex Deane, director of campaign group Big Brother Watch, told the Guardian: "Google should have been fined at the highest possible level. The information commissioner's failure to take action is disgraceful.
"Ruling that Google has broken the law, but then taking no action against it, shows the commissioner to be a paper tiger. The commissioner is an apologist for the worst offender in his sphere of responsibility, not a policeman of it.
"If Google can harvest the personal information of thousands of people and get off scot-free, then the ICO plainly has a contempt for privacy."
Google last month said it was "mortified" to learn that it had collected personal data from internet users, which included emails, passwords, URLS and some health records. The company admitted to the personal data collection in May, following an investigation by the German authorities, but the nature of what was collected only came to light after an investigation by the Canadian privacy commissioner.
The US internet giant is facing investigations in a number of countries around the world for the Wi-Fi data collection.
An investigation by the Canadian privacy commissioner found that Google's data harvesting occurred when a lone engineer programmed the company's Street View cars with code enabling them to scoop so-called "payload" data from unsecured wireless internet connections in the near vicinity.
Rob Halfon, the Conservative MP who organised last week's parliamentary debate on privacy and the internet, claimed that the information commissioner was prevented from taking stronger action against Google earlier this year because the DPA at the time limited his powers.
The ICO has since been given extra powers to fine organisations up to £500,000 for "serious breaches" of the DPA, though the commissioner said such a fine would not be imposed upon Google at this time.
Halfon today said: "Following my parliamentary debate last week, and my criticism of Google and the information commissioner, I welcome the ICO's admission that the Street View project was a significant breach of the Data Protection Act.
"However, the ICO has not so much locked the barn door after the horse has bolted, but called a fire engine after the barn has burnt down.
"The fact is that the ICO failed to act when it should have done, despite the fact that Google staged a significant infringement of privacy and civil liberties, by harvesting millions of emails, Wi-Fi addresses, and passwords.
"Furthermore, the ICO has already proved that it lacks the technical expertise to audit Google's activity. What confidence can we have in their audit now?
"People feel powerless. We need an internet bill of rights, to give ordinary people some right of redress, and a proper commission of inquiry to look into this."
Halfon yesterday tabled around 50 written questions about the role of the ICO and its investigation into the Google Wi-Fi data breach.
via Guardian
No comments:
Post a Comment