The U.K.’s Information Commissioner has spoken, and let Google off the hook. The Internet giant had been under investigation after harvesting individuals’ private data via its Street View cars. The verdict: unintentional. The punishment? Slapped wrists, the data to be deleted within nine months, and case closed. Wow. A result for Google, without a doubt.
“We’re pleased that the ICO have concluded their investigation and we will be working to delete the data as soon as possible,” a Google spokesperson tells Fast Company.
But how has it managed to get away without a fine?
In an interview with the BBC, the Information Commission’s deputy, David Smith, said that a fine was impossible. “We’d have had to find that there was substantial damage or distress to individuals from the collections of snippets of emails, URLs and passwords. We’d have to meet that criteria for a penalty to be imposed.”
One of the stranger aspects of the decision is the timeframe for deleting data. Is nine months significant when it comes to deleting data? Doesn’t one just press a delete button and have done with it? A source with direct knowledge of the investigation tells Fast Company that Google hasn’t thus far deleted the data, because U.K. authorities asked them not to during an investigation. Now, Google’s at the mercy of those investigators, who would presumably tell them what specific data they must delete.
Google has been fingered by a whole host of countries besides Britain, including South Korea, Germany, Switzerland, Spain, Canada, Hong Kong, Italy, and the U.S. for lax information gathering. Canada’s privacy commissioner said that it had “seriously violated” its privacy laws, after private medical information was harvested from individuals.
But the U.K.’s investigation was less thorough than that in Canada. “We spent less time searching than others did,” said Smith. “If we had searched for days and days we would have found more.” It was only on publication of Canada’s findings that Britain upgraded its results from “no significant breach” to “significant breach.”
The Information Commissioner himself said that the search engine firm’s agreement to delete its data was good enough for him. “It is a significant achievement to have an undertaking from a major multinational corporation like Google Inc. that extends to its global policies and not just its U.K. activities,” said Christopher Graham. “We will be keeping a close watch on the progress Google makes and will follow up with an extensive audit.”
However, there are three factors that may have contributed to the levity of Google’s punishment–if you can call it a punishment. Firstly, Google does not currently pay tax in the U.K. Due to Ireland’s low rate of corporation tax, the firm moves most of its foreign profits through the Irish office, meaning it does not pay tax in the U.K. As Europe moved to bail out Ireland this week, perhaps the British government has ensured a lighter-than-usual investigation in return for the firm completing a British tax return in the near future.
Secondly, rather like President Obama’s relationship with Google–his deputy CTO is Andrew McLaughlin, a former Google staffer–David Cameron has a contact high up in the firm. Rachel Whetstone, the firm’s European head of communications, is the partner of Cameron’s Director of Strategy, Steve Hilton.
And thirdly, as the British government starts the onerous task of moving everything online–including today’s vast mine of department spending data,
they are going to need advice on how to do it. Who better to ask than
Google? A little bit of mutual back-scratching could go down very well
on both sides–after all, Google didn’t harvest the data intentionally,
it was just an oversight. As more and more governments throughout Europe
follow Britain’s example, Google’s role in managing the world’s data
will become more widespread.