Google is to delete the sensitive information — including full emails and passwords — it illegally captured from Wi-Fi networks when its Street View cars mapped the UK’s towns and cities.
The technology giant has signed a commitment to improve its data handling following the Information Commissioner’s Office ruling that it committed a “significant breach” of the Data Protection Act (DPA) during the mapping in the past two years.
The ICO will also audit Google’s compliance with the DPA in August 2011.
Google’s collection of so-called “payload” data from unsecured Wi-Fi connections is under investigation in a number of countries around the world. The ICO ruled in July that the company was unlikely to have collected “significant amounts” of personal data with its Street View cars — only to decide in the first week of November that the company had in fact committed a “significant breach” of the DPA.
It is a “significant achievement” for a “major multinational corporation” like Google to commit to improving its data handling practices, the information commissioner Christopher Graham said on Friday. The ICO said it will continue to keep a “close watch” on Google’s data handling practices.
“I welcome the fact that the Wi-Fi payload data that should never have been collected in the first place can, at last, be deleted,” Graham said.
Alan Eustace, Google’s vice-president of engineering and research, has signed an undertaking committing the company to put in place improved training measures on security and data protection. Google will also now require product engineers to maintain a privacy design document for every new project before it is launched.
The ICO faced renewed criticism last week after the Ministry of Justice revealed that it had sent two “non-technical” members of staff to investigate Google’s collection of “payload” data from Wi-Fi connections.
The privacy watchdog has been labelled as an “apologist” for Google’s breach of data protection laws; Rob Halfon, the influential Conservative MP, said the ICO had acted “more [like] Keystone Cops than protector of our civil liberties” in its investigation.
Baroness Neville-Jones, the minister of state for security, this week dashed the hopes of privacy campaigners calling for fundamental reform of the ICO, telling the House of Lords that the embattled watchdog has “sufficient” and “significant powers”.
Halfon revealed in a parliamentary debate on privacy and the internet last month that Graham told him his office was hamstrung by U.K. data protection legislation when it came to taking action against Google, though he did not elucidate on how it was held back.
Neville-Jones on Wednesday said the ICO’s powers to investigate and penalise breaches of the DPA are “sufficient” and “very considerable”, appearing to rule out any prospect of reforming the office.
“In our view, the information commissioner has significant powers, and we would regard them as sufficient to examine and consider or scrutinise any of the data processed within the [Identity and Passport Service],” she told a House of Lords debate on the Identity Documents Bill.
Noting that the ICO has the power to find out whether companies or government departments are complying with the DPA, the minister said those powers were “very considerable.” “It is important for us to ensure that this is the case, and to talk to the Information Commissioner to ensure that he is able and willing to exercise his powers in this way, which I believe to be the case,” she said.
Copyright: Guardian News & Media 2010
