A response to Google: Basic data rights

My ZD Net blogging colleague, Garrett Rogers, excoriates Privacy International for its negative assessment of Google’s privacy policies. He suggests the New Zealand-based organization, founded more than a decade ago, came to its conclusion without information from Google. Privacy International says Google has launched a “smear campaign” against the report. I think that is overstating the reality, which is that Google is doing some damage control.

Garrett’s interpretation is certainly one-sided and contributes to the Giving up our privacy for a little Web functionality and storage capacity is like handing over the mining rights to ancestral lands to the first guy who comes along with a better shovelimpression that reaction, rather than reflection is in the air. In fact, Privacy International had extensive information based on published Google policy, speeches and other elements of the company’s public record (see the report methodology, which contradicts Garrett’s representation of the situation). The organization published its extensive methodology, demonstrating that its ratings of companies were not assembled in a vacuum. Google refused to answer additional questions, unlike other companies surveyed by Privacy International.

Garrett’s sarcastic link-filled quote, “Clearly Google doesn’t care about privacy,” misses the essential point Privacy International is illuminating: Privacy is not just about how you protect user data, it is how you use it to analyze and expose your customers to marketers. Defending your user’s data, from federal subpoena, for example, is only one small part of the privacy puzzle.

Most companies are pretty good at protecting the security of user data—at least, to the extent that we still raise an alarm when user data is exposed by a breach, whether accidental or cracker-related.

Google, as I have written many times, considers any and all data collected from users open to analysis and interpretation without any further permission. Note, I am not saying they sell the data to third parties. Google generates immense value from user data, it is the key to its billion-dollar-a-quarter profits. They use it to target offerings, even offerings we may not want to be exposed to, since offers on a page viewed over our shoulders (or monitoring by an employer) can be a form of privacy breach, too.

Here’s the standard we should ask ISPs and search providers, among others, to observe:

User data is the user’s data and may be used only with explicit permission. The opportunity to collect personal data does not provide a company ownership of that data. Merely notifying users that their online activity will be monitored and analyzed is not sufficient to ensure a company has lived up to its obligation to protect user privacy, since the privacy implications of different activities and searches conducted at different times are not uniform.

User data controlled by users may be less efficient than today’s blanket “privacy” policies, but at least it is economically worthwhile to demand that current Web use not be accompanied by the total surrender of our privacy. We don’t need to “get comfortable with less privacy,” as Mark Simon wrote in Search Insider on June 4. Rather, we need to start figuring out the value of personal information and profiting from it.

The next phase of network development will be focused on making user control of their data easier, fair and, potentially, profitable, as recent research has shown that users are willing to trade some personal data for better prices. Just giving up our privacy for a little Web functionality and storage capacity is like handing over the mining rights to ancestral lands to the first guy who comes along with a better shovel.