Reding Says Google Does Not Respect EU Rules

EU Justice Commissioner Viviane Reding has slammed Google for not respecting EU rules while a German data watchdog has given the search giant one week to hand over a hard drive containing private Wi-Fi data the search giant harvested.

Google faces criticism from regulators in Europe because it admitted last week that its Street View cars, which shoot pictures of streets and locations all over the world for use in Google Maps, had unwittingly captured around 600 Gbyte of “payload data” from unsecured Wi-Fi networks.

The data haul includes e-mail, passwords and browsing habits from people in the United States, Germany, Britain, Ireland, France, Brazil and Hong Kong over the last three years.

The company says it did not use this data and is working with the affected countries to delete, but this is not impressing European regulators who, along with their US counterparts, may well investigate the company – which has already been criticised over fears that its Street View images break privacy, and has seen UK villagers blocking the cars’ approach.

Google “not acceptable” – Reding

Viviane Reding, Justice Commissioner for the European Union in Brussels, said in a statement sent to eWEEK  that it “is not acceptable that a company operating in the EU does not respect EU rules.”

Reding added that she reminded Google co-founder Larry Page during a meeting last June that all companies that operate in the EU must abide by the European Union’s high standards of data protection and privacy. The meeting followed EU concern over Street View privacy as early as last May.

She noted that the processing of personal data by Google Street View falls within the scope of the Data Protection Directive 95/46/EC and is therefore subject to its provisions.

Hand over data – Hamburg watchdog

Across Europe, regulators are talking very tough with Google.

Johannes Caspar, the data protection supervisor for the city state of Hamburg in Germany told the New York Times that he is giving Google until 26 May to hand over one of the hard drives that it used to store information in Germany, or he would consider fining the company.

“Up until now, all we have to go on at this point is what Google has told us that they have collected,” Caspar told the Times. “But until we can inspect one of the hard drives ourselves, we will not know to what extent what kinds of data have actually been stored.”

Street View is not yet available in Germany, ratcheting up the pressure on privacy watchdogs such as Caspar to save face by pushing Google hard for the data. Caspar said  he could impose fines on the company and could ask the state prosecutor in Hamburg to consider bringing charges against Google for “improper collection of private data.”

Meanwhile, the UOOU, the Czech data protection agency, launched an administrative investigation into Google’s practices, according to the Financial Times. The FTC may also open an inquiry into Google’s admission of data harvesting.

Google explained the Wi-Fi data collection in this blog post, but declined to add anything about the threats of action against the company when contacted by eWEEK. “We don’t have anything to add beyond what we’ve said in our blog post. We’re continuing to have discussions with the relevant authorities,” a spokesperson said.

Ireland supervised data destruction

Part of those discussions involve how best to go about deleting the data and progress has already been made in Ireland, where Alex Stamos, partner for iSEC Partners, said he oversaw the physical destruction of four hard drives that housed payload data Google collected in Ireland.

“We can confirm that all data identified as being from Ireland was deleted over the weekend in the presence of an independent third party,” wrote Alan Eustace, senior vice president of engineering and research at Google.

“We are reaching out to Data Protection Authorities in the other relevant countries about how to dispose of the remaining data as quickly as possible.”