ICO: Google must build privacy into products

Privacy changes made by Google “reduce but don’t eliminate” the risk of another data debacle like the Street View Wi-Fi scrape, according to the ICO.

Last year, Google admitted its Street View camera car had collected snippets of data while scanning for Wi-Fi networks. The ICO didn’t choose to levy a fine, but instead required Google to change its data management with an eye to improving privacy, and produce a report detailing the changes.

The ICO has now audited that Privacy Report, which is confidential – meaning the public can only read the Information Commissioner’s report on the report.

The company needs to ensure its work in this area continues to evolve alongside new products and technologies

While the ICO approved the report and endorsed the changes, it called for Google to create Privacy Design Documents for every product, to ensure data protection was built in.

The ICO also warned that Google still wasn’t ensuring internal compliance, meaning “there is therefore a substantial risk that the objective of data protection will not be achieved”. It recommended “immediate action” to improve compliance controls.

Overall, however, the ICO praised Google’s progress, notably for setting up a series of Privacy Teams to watch over the area, which include legal representatives as well as engineers. Google has also developed an online training system to ensure staff are skilled in data protection.

“The ICO’s Google audit is not a rubber stamp for the company’s data protection policies,” Information Commissioner Christopher Graham said. “The company needs to ensure its work in this area continues to evolve alongside new products and technologies. Google will not be filed and forgotten by the ICO.”

Google’s director of privacy welcomed the changes, and said Google looked forward to continuing to work with the ICO.

“We have worked hard on these new privacy controls, which are designed to improve our internal practices without getting in the way of the innovation that has powered Google since its inception,” said Alma Whitten in a blog post. “We know that there is no perfect solution, so we will continue to improve our current processes and develop new ones so that privacy awareness grows and evolves alongside Google.”