Article by Charlotte Walker-Osborn Head of TMT Sector and Sam Jardine Associate, Commercial
What? The Information Commissioner's Office (the 'ICO') has just released details of its July audit of certain of Google's privacy procedures. The ICO commends the efforts that have been made so far by Google and has provided further guidance on several areas for future focus, which will be relevant to many technology businesses.
So what? This is good news for Google following the regulatory and media privacy criticism received by it and other big US players over the last 2 years. This also shows that European regulators will take action against overseas businesses but most importantly gives an insight into what the ICO thinks technology companies should be doing in relation to product, system and service developments.
The ICO investigated Google's use of "Street View" data collection vehicles. Google had sought to use them to also collect details on WiFi access points in order to map their location to support mobile applications but the vehicles had at the same time mistakenly collected some payload data, which was likely to include emails, URLs and passwords of private individuals. As a result, Google Inc gave a compliance undertaking last year to the ICO which included the following commitments:
- Continue and update orientation programs designed to provide Google employees with training on Google's privacy principles which are set out online (click here to view) and which are consistent with the privacy laws of the UK.
- Institute a policy that requires Google employees to be trained on Google's code of conduct. The code of conduct includes sections on privacy and the protection of user data that are consistent with the privacy laws of the UK.
- Enhance the core training for engineers and other important groups with a particular focus on the responsible collection, use and handling of data.
- Institute a security awareness program for Google employees, which will include guidance on both security and privacy.
- Institute a policy that requires engineering project leaders to maintain a privacy design document for each initiative they are working on which involves the processing of significant user data, and a policy that such document should (a) record how such user data is handled and (b) be reviewed regularly by managers.
- Delete payload data that has been identified as having been collected by Google in the UK, to the extent that Google has no other outstanding legal obligation to retain such data.'
Google also agreed to permit the ICO to carry out an audit of agreed areas of operation – a level of scrutiny many businesses would prefer to avoid. The audit took place in July 2011 focussing on an agreed scope, so it did not cover all Google privacy policies and procedures. The audit consisted of a review of Google's relevant online documents and sites, interviews with selected staff and inspection of Google's records at Google's London office, carried out in line with recommended ICO good audit practice. The audit concluded that Google had complied with the terms of the undertaking and that Google had implemented all of the changes suggested within the 8 month period between the undertaking and audit. The ICO noted that Google had undertaken the data protection training agreed to in the undertaking and that Google had developed its own in-depth privacy structure, building privacy into its projects, and improving its resources dedicated to privacy.
The Information Commissioner Christopher Graham said that "all of the commitments [Google] gave us have been progressed and the company have also accepted the findings of our audit report to go even further". This will be a relief for Google following recent unwanted regulatory attention in relation to privacy issues on both sides of the Atlantic but for Google, like all other businesses, compliance is an ongoing daily activity and as the ICO noted "The company needs to ensure its work in this area continues to evolve along with new products and technologies. Google will not be filed and forgotten by the ICO".
The audit highlighted specific areas of good practice identified by the ICO which Google had developed, including:
- A Privacy Design Document, so that all new projects undergo an in-depth assessment to ensure that privacy is built in from the start.
- The implementation of an internal privacy structure across all functions of the business, enhancing privacy resources and their visibility across the office.
- Introducing advanced data protection training for all engineers.
- Providing enhanced privacy training for all staff, including on the protection of user data.
The comments emphasize again the importance which the ICO places on the consideration of privacy issues at the outset in relation to new systems, technologies, products and offerings and how important it believes the right training is. In this context, questions about such design process and relevant training are likely to be part of any ICO investigation and decision making on enforcement action. The adoption of a strong and recognizable internal privacy function is also going to be a growing theme, with regulatory consideration of a mandatory data protection officer role, as already exist in some member states.
The ICO also made some further recommendations as a result of the audit, including the following suggestions:
- Products should have a "privacy story", being an explanation of how data will be managed in a product and used to provide users proactively with information about the privacy features of products.
- Projects should have an appropriate Privacy Design Document, with suitable processes to check them for accuracy and completeness.
- Engineers should have core training, around specific engineering disciplines, taking account of the outcomes of the Privacy Design Document.
These suggestions by the ICO indicate the approach which it is expecting all technology businesses to implement and will require radical changes in attitudes and procedures for some businesses, especially those who have adopted a US style attitude to what amounts to protected personal data and how far they are willing to go to safeguard it.
Click here for the results of the ICO audit.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
