Google Buzz Privacy Concerns

Google, like all multinational corporations, must abide by non-U.S. jurisdictions privacy laws when they launch products in those jurisdictions.

There were a storm of protest and outrage in 2009-2010 over alleged privacy violations and several authorities also had questions about how Google Buzz has met the requirements of privacy law in their respective jurisdictions.

Several privacy authorities around the world (such as Canada and Germany) also expressed disappointment that, despite the clear and significant privacy implications, Google failed to consult them prior to unveiling Buzz in their countries.

Buzz was added as a feature on Google’s Gmail, which reportedly has 146 million users worldwide, last week.

Some Gmail users have alleged that they were automatically – and without adequate consent or prior notice – assigned a network of “followers” based on the people with whom they communicated most often using Google’s e-mail and chat services. They also alleged that, by default, this list of “followers” was included in a widely available online profile.

Google has since issued a public apology and introduced changes to try to address the widespread criticism. The company has said that further changes will be introduced this week.

Overlooking privacy values and legislation when Google launchs new online products

The heads of some of the data protection authorities signed, in April 2010, a joint letter to Google Inc. They were expressing deep concern about his company’s privacy practices, particularly in relation to the recent launch of its social network, Google Buzz.

The letter, signed by the heads of data protection authorities in Canada, France, Germany, Ireland, Israel, Italy, the Netherlands, New Zealand, Spain and the United Kingdom, stated:

“(W)e are increasingly concerned that, too often, the privacy rights of the world’s citizens are being forgotten as Google rolls out new technological applications. We were disturbed by your recent rollout of the Google Buzz social networking application, which betrayed a disappointing disregard for fundamental privacy norms and laws. Moreover, this was not the first time you have failed to take adequate account of privacy considerations when launching new services.”

The data protection authorities go on to note that the privacy problems associated with the initial global rollout of Google Buzz in February should have been “readily apparent” to the company.

Google Mail, or Gmail, had been a private, one-to-one web-based e-mail service, but was abruptly melded with a new social networking service. Google automatically assigned users a network of “followers” from among people with whom they corresponded most often on Gmail, without adequately informing those users about how this new service would work or providing sufficient information to permit informed consent.

These actions violated the fundamental, globally accepted privacy principle that people should be able to control the use of their personal information.

Gmail users – understandably concerned that their personal information was being disclosed – were highly critical of the new service. In response, Google apologized and quickly introduced changes to address the widespread criticism.

Previously, Google has raised significant privacy concerns in many countries with the launch of its Street View service, which displayed images of street scenes on the Internet.

In the letter, the data protection authorities recognized that Google is not the only online company that has introduced services with inadequate protections for privacy. However, they urged Google to set an example “as a leader in the online world.”

“We therefore call on you, like all organizations entrusted with people’s personal information, to incorporate fundamental privacy principles directly into the design of new online services.”

The letter makes specific recommendations for enhancing privacy protections and asks Google to explain how it will comply with national privacy laws in the future.