February 09, 2012

EPIC's "Google Privacy Lawsuit" Against FTC Doesn't Hold Water

In the wake of Google's announced privacy policy changes and consolidations, which I discussed in considerable detail within Google's Privacy Policy Changes: Revolution? Evolution? Or Confusion?, now comes word that EPIC (the Electronic Privacy Information Center) has filed suit against the FTC (Federal Trade Commission), asserting that the FTC is not enforcing the terms of their 2011 consent decree with Google.

EPIC has done a lot of great work in the past, but of late seems to find claimed fault with virtually everything Google does.

What's really a head-scratcher in the case of this new suit is that you don't need to be a lawyer to question its veracity, you need only read over the relevant documents for yourself.

Nobody can reasonably claim that Google hasn't given plenty of notice about these changes. Between Google's associated blog postings, website notices, and email notifications on this issue, there arguably hasn't been so much global attention to an Internet-oriented policy topic for quite a long while.

The key focus of EPIC's lawsuit appears to be Google's plans to consolidate user data across various services associated with individual Google accounts.

But as I've previously noted, the consolidation of Google privacy policies can only reasonably be viewed as a positive for users, and an individual account is the logical unit for data consolidation as well, enhancing user services capabilities in significant ways.

Given that Google is not increasing the amount of data being collected or sharing personally identifiable user information with third parties, and since users can easily create multiple free Google accounts to separate their services usage if they really desire such compartmentalization, it's difficult to see what all the fuss is actually about.

In particular, the FTC consent decree with Google (relating to the launch of Google Buzz, a controversy that I've always felt was significantly overblown) includes this language:

“Third party” shall mean any individual or entity other than: (1) respondent; (2) a service provider of respondent that: (i) uses or receives covered information collected by or on behalf of respondent for and at the direction of the respondent and no other individual or entity, (ii) does not disclose the data, or any individually identifiable information derived from such data, to any individual or entity other than respondent, and (iii) does not use the data for any other purpose; or (3) any entity that uses covered information only as reasonably necessary: (i) to comply with applicable law, regulation, or legal process, (ii) to enforce respondent’s terms of use, or (iii) to detect, prevent, or mitigate fraud or security vulnerabilities.

EPIC appears to be claiming that the new Google privacy policy changes will somehow violate the third-party aspects of the consent decree.

This appears to be utterly erroneous. If I choose to use multiple Google services under a single Google account, I'm still just one party!

There's no "third party" involved if my Google searches are used to help tailor the ads I'm shown on YouTube, as well as on Google Search itself. It's all one account. It's me, myself, and I! Look in the mirror if you dare -- it's still the same person.

Google's privacy policy changes don't share my personal account data with other parties. They don't even share my data between separate Google accounts I can choose to use for different Google services if I wish.

You can reread the consent decree until you go cross-eyed, but EPIC's complaint still dissolves into the same sort of phantasm as a dream that fades from memory within moments of waking -- there's no real substance there at all.

I won't speculate about the motives behind the various parties spewing hateful hyperbole about all this, beyond saying that it's obvious that Google's competitors would love to see Google prevented from engaging in innovation whenever possible.

But from my standpoint, it's the users themselves who matter most. If Google were commingling personal data between separate Google user accounts, or providing personal data to actual third parties, there could indeed be cause for concern.

However, that's not what's happening, and users still have full control over how they use Google services -- with single accounts, multiple accounts, or for some services with no accounts at all.

And once again, the consolidation of more than 60 different privacy policies into just a few is a definite plus for users.

It is ultimately detrimental to the cause of genuine privacy concerns to view every change from the status quo as automatically negative. Such an approach tends to perpetuate the same sort of toxic environment that has enveloped so much of our public discourse, to no good end.

If nothing else, it would be extremely useful if we engaged in dialogues on these issues based on a foundation of facts, rather than emotional mischaracterizations.

Something to ponder perhaps, both regarding Internet issues, and in relation to the other aspects of our lives as well.


Posted by Lauren at February 9, 2012 12:20 PM | Permalink
Twitter: @laurenweinstein
Google+: Lauren Weinstein