This article is from the source 'nytimes' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.nytimes.com/2013/03/13/technology/google-pays-fine-over-street-view-privacy-breach.html

The article has changed 6 times. There is an RSS feed of changes available.

Version 0 Version 1
Google Pays Fine Over Street View Privacy Breach Google Admits Drive-By Data Collection Was Privacy Breach
(35 minutes later)
Google has agreed to pay $7 million as a result of an investigation brought by a coalition of state attorneys general, officials said Tuesday, in one of the largest fines for violating privacy in the digital age. SAN FRANCISCO — Google on Tuesday acknowledged to state officials that it had violated people’s privacy during its Street View mapping project when it casually scooped up passwords, e-mails and other personal information from unsuspecting computer users.
The fine stems from the Street View case, where Google deployed special vehicles to photograph the houses and offices lining the world’s streets. But for several years the company was also secretly collecting personal information — e-mails, medical and financial records, passwords — as it cruised by. It was data-scooping from millions of unencrypted wireless networks. In agreeing to settle a case brought by 38 states involving the project, the search company for the first time is required to aggressively police its own employees on privacy issues and to explicitly instruct the public about how to fend off privacy violations like this one.
“Consumers have a reasonable expectation of privacy,” George Jepsen, Connecticut attorney general, said in a statement Tuesday. “This agreement recognizes those rights and ensures that Google will not use similar tactics in the future to collect personal information without permission from unsuspecting consumers.” While the settlement also included a tiny — for Google — fine of $7 million, privacy advocates and Google critics characterized the overall agreement as a breakthrough for a company they say has become a serial violator of privacy, with multiple enforcement actions in recent years and a slew of worldwide investigations into the way the mapping project also collected the personal data of private computer users.
As part of the settlement, Google agreed that it had acted improperly and agreed to engage in a comprehensive employee education program about privacy and to inform the public about securing wireless networks and protecting personal information. Thirty-eight states participated in the investigation. “Google puts innovation ahead of everything and resists asking permission,” said Scott Cleland, a consultant and consumer watchdog whose blog maintains a close watch on Google’s privacy issues. “But the states are throwing down a marker that they are watching and there is a line the company shouldn’t cross.”
Google has repeatedly been faulted by regulators for privacy violations. Last summer the search giant paid $22.5 million to settle Federal Trade Commission charges that it had bypassed the privacy settings on Apple’s Safari browser. That fine, the largest civil penalty ever levied by the F.T.C., came after Google agreed to be audited by the agency for 20 years for privacy violations related to a social networking feature. The agreement paves the way for a major privacy battle over Google Glass, the much-hyped wearable computer in the form of glasses, Mr. Cleland said. “If you use Google Glass to record a couple whispering to each other in Starbucks, have you violated their privacy?” he asked. “Well, 38 states just said they have a problem with the unauthorized collection of people’s data.”
Some of Google’s most severe critics, who feel that the company is so big and powerful that it often eludes censure, pronounced themselves pleased with the attorneys general’s actions. George Jepsen, the Connecticut attorney general who led the states’ investigation, said that he was hopeful the settlement would produce a new Google. “This is the industry giant,” he said. “It is committing to change its corporate culture to encourage sensitivity to issues of personal data privacy.”
“This is a significant privacy decision,” said Marc Rotenberg, executive director of the Electronic Privacy Information Center. He noted it was more than 200 times the amount the Federal Communications Commission had fined Google last year for obstructing its own Street View investigation. The applause was not universal, however. Consumer Watchdog, another privacy monitor and frequent Google critic, said that “asking Google to educate consumers about privacy is like asking the fox to teach the chickens how to ensure the security of their coop.”
Still, the attorneys general’s fine is a pittance for Google, which has a net income of about $32 million a day. Niki Fenwick, a Google spokeswoman, said on Tuesday that “We work hard to get privacy right at Google, but in this case we didn’t.”
“It is the public opprobrium, not the money, that counts in these cases,” said David Vladeck, a professor of law at Georgetown University who directed the F.T.C.’s Bureau of Consumer Protection. “And I think people were rightly unhappy with Google’s collecting the information in the first place and then Google’s lame explanation.” Last summer, the Federal Trade Commission fined Google $22.5 million for bypassing privacy settings in the Safari browser, the largest civil penalty ever levied by the F.T.C. In 2011, Google agreed to be audited for 20 years by the F.T.C. after it admitted to using deceptive tactics when launching its Buzz social network. That agreement included several rather vague privacy provisions.
Google initially denied any data had been collected from unknowing individuals, then sought to downplay what it had and fought with regulators who wanted to examine the data. The new settlement, which requires Google to set up a privacy program within six months, is more specific. Among its requirements, Google must hold an annual privacy week event for employees. It also must make privacy certification programs available to key employees, provide refresher training for its lawyers overseeing new products and train its employees who deal with privacy matters.
“We work hard to get privacy right at Google,” said Niki Fenwick, a spokeswoman. “But in this case we didn’t.” She added that Google has since improved its “systems.” Several provisions involve outreach. Google must create a video for YouTube explaining how people can easily encrypt their data on their wireless networks and run a daily online ad promoting it for two years. It must run educational ads in the biggest newspapers in the 38 participating states. Among the participating states besides Connecticut are New York, New Jersey, Massachusetts, California and Ohio.
The attorneys general investigation began in June 2010. Richard Blumenthal, then Connecticut’s attorney general, said his office would lead a multistate investigation into what he called “Google’s deeply disturbing invasion of personal privacy.” “There are minimum benchmarks Google has to meet,” said Matthew Fitzsimmons, an assistant Connecticut attorney general who negotiated with the company. “This will impact how Google rolls out products and services in the future.”
In December 2010, Mr. Blumenthal issued a civil investigative demand, equivalent to a subpoena, to get the data. Google never gave Connecticut any data. Marc Rotenberg of the Electronic Privacy Information Center said the agreement was “a significant privacy decision by the state attorneys general,” adding that “it shows the ongoing importance of the states’ A.G.’s in protecting the privacy rights of Internet users.”
The Street View case arose out of Google’s deployment of special vehicles to photograph the houses and offices lining the world’s roads and boulevards. For several years, the company also secretly collected personal information — e-mails, medical and financial records, passwords — as it cruised by. It was data-scooping from millions of unencrypted wireless networks.
A worldwide uproar and investigations in at least a dozen countries ensued. An Australian regulator, Stephen Conroy, called it “probably the single greatest breach in the history of privacy.” Google initially denied any data had been collected from unknowing individuals, then sought to downplay what data had been collected and fought with regulators who wanted to examine it. Google said the data had been destroyed, although it turned out some had not been. Some data was purged, but Google is holding the rest until several private lawsuits are resolved.
The company blamed a rogue engineer for the operation. But a Federal Communications Commission investigation said the engineer had worked with others and tried to inform his superiors about what he was doing. He was less a rogue than simply unsupervised, the agency concluded. The F.C.C. last summer fined Google $25,000 for obstructing its investigation.
Over the last several years, Google has repeatedly said it was strengthening its privacy monitoring, adding layers of oversight and controls. For the states, however, those assurances were not quite enough.
“We obviously thought there was more they could do,” said Mr. Fitzsimmons, the assistant Connecticut attorney general. An executive committee of attorneys general will monitor Google for compliance.
The $7 million fine is pocket change for Google, which has a net income of about $32 million a day.
“It is the public opprobrium, not the money, that counts in these cases,” said David Vladeck, a professor of law at Georgetown University who formerly directed the F.T.C.’s Bureau of Consumer Protection. “And I think people were rightly unhappy with Google’s collecting the information in the first place and then Google’s lame explanation.”
Regulators in Germany pursued Google aggressively in the case, more so than anywhere else without bringing charges. That seemed to end the matter until this week. Few outside observers expected the states’ efforts to ever amount to much.
The inquiry began in June 2010. Richard Blumenthal, then Connecticut’s attorney general, said his office would lead a multistate investigation into what he called “Google’s deeply disturbing invasion of personal privacy.” In December of that year, Mr. Blumenthal — on the verge of becoming Connecticut’s junior senator — issued a civil investigative demand, equivalent to a subpoena, to get the data. Google never provided it.
“That issue was resolved by their admission they had gathered the kinds of data we had alleged they were gathering,” said Mr. Jepsen, the attorney general.
In any case, he said, “What mattered was Google admitted they weren’t just taking pictures.”

Kevin O’Brien contributed reporting from Berlin.