Google Data Admission Angers European Officials

By KEVIN J. O’BRIEN

Published: May 15, 2010

BERLIN — European privacy regulators and advocates reacted angrily Saturday to the disclosure by Google, the world’s largest search engine, that it had systematically collected private data since 2006 while compiling its Street View photo archive.

Related

• Google Says It Collected Private Data by Mistake (May 15, 2010)

• Bits Blog: Google Inadvertently Collected Private Data (May 14, 2010)

After being pressed by European officials about the kind of data the company compiled in creating the archive — and what it did with that information — Google acknowledged on Friday that it had collected snippets of private data around the world. In a blog post on its Web site, the company said information had been recorded as it was sent over unencrypted residential wireless networks as Google’s Street View cars with mounted recording equipment passed by.

The data collection, which Google said was inadvertent and the result of a programming error, took place in all the countries where Street View has been catalogued, including the United States and parts of Europe and Asia. Google apologized and said it had not used the information, which it plans to delete in conjunction with regulators.

But in Germany, Google’s collection of the data — which the company said could include the Web sites viewed by individuals or the content of their e-mail — is a violation of privacy law, said Ilse Aigner, the German minister for food, agriculture and consumer protection. In a statement Saturday, her ministry demanded a full accounting.

“Based on the information we have before us, it appears that Google has illegally tapped into private networks in violation of German law,” Ms. Aigner said. “This is alarming and further evidence that privacy law is a foreign concept to Google.”

Johannes Caspar, the data protection supervisor for Hamburg, who is leading the German government’s dealings with Google on the issue, said the company’s revelation of illegal data collection would be taken up by a panel of European national data protection chiefs that advises the European Commission.

“This is a data scandal of a much larger magnitude,” Mr. Caspar said. “We are talking here about the large-scale collection of private data on individuals.”

He declined to speculate what action European officials might take.

Mr. Caspar said he had inspected one of Google’s Street View recording vehicles at the company’s invitation this month and had noticed that the recording device’s hard drive had been removed. When he asked to view the drive, he said he was told he couldn’t read the information anyway because it was encoded. He said he pressed Google to disclose what type of information was being collected, which prompted the company to examine the storage unit.

“I am glad that this cat-and-mouse game with Google is finally over,” Mr. Caspar said. “I hope now that the company does what it says it will do.”

“I think this is going to damage the company irreparably,” said Simon Davies, the director of Privacy International, a London-based group of privacy advocates from 40 countries. “Three years ago the company was wearing a halo. But over the past year it has moved substantially in the direction of being perceived as Big Brother.”

Kay Oberbeck, a Google spokesman in Hamburg, said the company was in contact with data protection officials in Germany and in the rest of Europe to address their concerns. He disputed the notion that Google was recklessly collecting private information, saying the company’s services were meant to let users control what information is made public.

“This was obviously a mistake, and we are profoundly sorry,” Mr. Oberbeck said. “We take individual privacy very seriously at Google. There was a breakdown in the communication between teams and within teams, and we are investigating this and want to take up the lessons we learn from this to improve our processes and to have instruments installed which are really robust to make this never happen again.”

Google was collecting the data on locations of wireless networks to improve geolocation for mobile devices. Some cellphones can determine their location by scanning for nearby wireless networks and comparing that information to databases like the one Google has compiled.

Google plans to hire an outside auditor to investigate what personal data was collected through Street View. The improper collection of data came to light, Mr. Oberbeck said, after German data protection officials asked Google two weeks ago to detail exactly what information it had collected from household wireless local area networks, or WLANs.

Initially, Google had told German officials that the data it had collected was limited to just two bits of information: the publicly broadcast ID number of the device, which is called a MAC address, and the name assigned to it by the owner, called an SSID.

Related

• Google Says It Collected Private Data by Mistake (May 15, 2010)

• Bits Blog: Google Inadvertently Collected Private Data (May 14, 2010)

But in its review, Mr. Oberbeck said the company learned that its data collection performed by roving Street View vehicles was much more extensive, including a record of sites viewed by the user and potentially the contents of messages if users did not secure their WLANS with a password.

Despite its internal efforts to address the situation, Google may face an uphill battle in Germany overcoming skepticism about its intentions. So far, thousands of Germans have signed up to have their properties excluded from Google’s Street View archives.

If Google’s software makes a mistake, it could be costly for the company. Till Steffen, the justice senator for the city-state of Hamburg, where Google’s German headquarters is located, said Google’s latest disclosure raised questions about its intent to follow local laws.

Mr. Steffen has introduced a bill in the German Parliament that would fine Google for displaying personal property in Street View without the consent of owners. On Saturday, he demanded that Google turn over the illegally obtained information to regulators.

“Google is in the process of frittering away its last shred of credibility,” Mr. Steffen said. “The company must immediately disclose to what degree it has secretly eavesdropped as we’ve sent e-mails to friends in Germany and the rest of Europe or as we’ve done our banking in the Internet.”

Mr. Steffen on May 7 introduced a bill in the upper house of the German Parliament that would fine Google 50,000 euros, or $62,500, for each time it failed to remove the personal property of a citizen who requested to be exempted from Street View. Action on the bill is not likely before summer.

The latest episode will further complicate Google’s business in Europe, where the company has faced a series of legal entanglements over privacy issues.

In April, data protection regulators from eight European countries and Israel and New Zealand sent a joint letter to Google’s chief executive, Eric E. Schmidt, criticizing the company’s Buzz social networking service, which unwittingly publicized the connections of some users without their permission.

In Switzerland, Google has agreed to halt the display of further Street View images pending the outcome of a court case lodged by Swiss federal data protection officials.