The Privacy Commissioner Completed the Compliance Check on Google’s Collection of Wi-Fi Payload Data

1.    The Privacy Commissioner for Personal Data ("the Commissioner") Mr. Roderick B. WOO has today informed Google Inc. (“Google”) the result of his compliance check on the collection of Wi-Fi payload data captured by Google through its Street View car operation in Hong Kong during the period from December 2008 to October 2009.

Background

2.    Google announced on 14 May 2010 that it had mistakenly collected unencrypted Wi-Fi payload data which might contain personal data (“the Data”) when only the addresses of Wi-Fi routers should have been recorded for their location services when taking pictures using the Google Street View cars in a number of locations (including Hong Kong) in the past few years.

3.    In exercise of his regulatory functions to supervise and monitor compliance with the requirements of the Personal Data (Privacy) Ordinance (“the Ordinance”), the Commissioner commenced a compliance check against Google on 17 May 2010.

The Commissioner’s Decision

4.    After protracted enquiries the Commissioner has decided not to carry out a formal investigation. The reasons are detailed in his Report. The main bases of the decision are that he is reasonably satisfied that:

(a)    the Data do not contain any meaningful details that can directly identify any one individual;
(b)    Google had no intention to compile personal information through the Street View car operation in Hong Kong; and
(c)    Google had not accessed or used any of the Wi-Fi payload data captured in Hong Kong through the operation.

Deletion of the Data

5.    The Commissioner has asked Google to completely and irreversibly erase all the Wi-Fi payload data collected in Hong Kong and to provide to the Commissioner a third-party verification of such erasure.

6.    The Commissioner said: “This incident has aroused global privacy concern and many overseas data protection authorities have looked into similar incidents in their own jurisdictions.  To date, Hong Kong was the only privacy regulator which had successfully procured an Undertaking and an Affidavit from Google.  I am pleased to say that this Office has gainfully used its limited resources in resolving this matter expeditiously and effectively.  Google has confirmed that its Undertaking, to the extent that certain items therein have yet to be implemented, shall continue to be in force, which, in my view, indicates Google’s commitment to comply with the requirements of the Ordinance.”

7.    The Commissioner’s Report in this matter is available for download at http://www.pcpd.org.hk/english/publications/files/Google_result_e.pdf.




END