Google's admittance in October that it mistakenly collected sensitive data with its Street View cars was resolved this week with Google SVP, Alan Eustace, signing a commitment to delete all sensitive data collected. The agreement, put in place by the Information Commissioner's Office, also requires Google to instigate new measures that ensure employees are more aware of 'security and privacy' issues.
Google first brought the issue to the attention of the Information Commissioner through a public blog, in which they explained that, in the process of collecting data on publicly available Wi-Fi radio signals, they had mistakenly also collected payload data. This included email addresses, URLS and passwords.
Google explains Street View position
Google's undertaking, which is available to view publicly on the internet, states that their purpose had been to, "identify Wi-Fi networks and to map their approximate location using the GPS co-ordinates of the [Google Street View] car." It goes on to state that: "The aim was to build and improve the geo-location database for location-based mobile applications."
It is noted on the document that the Information Commissioner could have used his powers to serve an Enforcement Notice under section 40 of the Data Protection Act but that he would not be doing so, "in the light of evidence available to him." The investigation is stated as being 'closed' but a seven-point undertaking is detailed for Google to abide by, to be completed within three years. This includes a number of training and improvement measures surrounding data security and privacy, as well as an agreement to, "delete payload data that has been identified as having been collected by Google in the UK."
Google state emphatically on their blog that they are 'mortified' by the breach of data privacy and are keen to emphasise that it was purely accidental. This undertaking from The Information Commissioner will be seen as a slap on the wrist for the technology giant but, especially with its very public nature, an embarrassing one nevertheless.