Agreement bans unauthorized data collection, mandates employee training on privacy and requires national campaign to educate consumers
BALTIMORE (March 12, 2013)—Attorney General Douglas F. Gansler, joined by 37 states and the District of Columbia, on March 12 announced a wide-ranging settlement with Google over its collection of data from unsecured personal and business wireless networks nationwide between 2008 and May 2010 while taking photographs for its “Street View” mapping service. Attorney General Gansler previously raised concerns with Google about its collection of personal information from consumers over unsecured wireless networks. Under this settlement, Google is banned from such data collection, required to train employees on privacy, must produce a national campaign to educate consumers about protecting their personal information and pay a $7 million penalty to the states participating in the settlement.
“Technology’s increasing reach brings increasing risks to consumer privacy that must be carefully managed and protected,” said Attorney General Gansler, who as president of the National Association of Attorneys General, is spearheading a national initiative entitled “Privacy in the Digital Age,” focusing on the privacy rights of individuals who use the Internet. “Our office takes consumers’ online privacy rights very seriously, especially when companies fall short in their handling of private information. This settlement agreement ensures that Google recognizes the privacy rights of individuals whose information was collected without their permission.”
To collect mapping data for its Street View service, Google used cars equipped with antennae and open-source software while roaming streets and taking pictures. The company has acknowledged collecting network identification information from unsecured business and personal wireless networks for use in future geolocation services, otherwise known as payload data.
In May 2010, Attorney General Gansler requested that Google segregate and secure the payload data it obtained and take steps to prevent this type of unauthorized data collection from reoccurring. Google has since disabled or removed the equipment and software used to collect payload data from its Street View vehicles, agreed not to collect any additional information without notice and consent, and destroy the data it collected.
Further, Google has confirmed that the payload data was not used, and will not be used, in any product or service, and that the information collected in the United States was not disclosed to any third party.
While Google represented it was unaware the payload data was being collected, the company acknowledged in the settlement agreement that the information it collected may have included URLs of accessed Web pages, partial or complete email communications, and any confidential or private information being transmitted to or from network users while the Street View cars were driving by. Additionally, Google collected and stored data frames and other data being transmitted over those unsecured wireless networks.
Other key elements of the agreement require Google to run an employee training program about privacy and confidentiality of user data for at least 10 years. It must also conduct a public service advertising campaign to help educate consumers about steps they may take to better secure their personal information while using wireless networks.
Source: Office of Attorney General Douglas F. Gansler