1. The Privacy Commissioner for Personal Data, Roderick B. Woo (“the Commissioner”), today met with Ross LaJeunesse, the Asia Pacific’s Head of Government Affairs in Google Inc. The Commissioner asked for an account of Google’s collection of personal data through Wi-Fi network in its Street View operation in Hong Kong.
2. Google had earlier admitted that its “location search service” only needed to collect and record the locations of Wi-Fi routers but the Street View cars had mistakenly collected and recorded non-password protected data which might have included personal data.
3. During the hour-and-half meeting, the Commissioner recalled that when the Street View commenced operation in Hong Kong, Google had stated that the Hong Kong people’s privacy in relation to their personal data would be protected. However, unbeknown to the public, Google had been collecting their personal data through the Wi-Fi network. In this respect, Ross LaJeunesse expressed Google’s deep regret to the Commissioner.
4. The Commissioner required Google to take all practical measures to remedy the situation and to ensure similar incidents will not happen. Ross LaJeunesse indicated that Google would agree in principle to the Commissioner’s following proposals and would :-
(a) suspend all Street View cars until it is
confirmed that the operation does not collect personal data;
(b) submit to the Commissioner all the data collected
in Hong Kong through the Wi-Fi network for inspection and would render
such assistance as may be needed to facilitate the inspection;
(c) as and when required by the Commissioner, delete
all data collected through the Wi-Fi network (save the non-personal
data already extracted) and to provide the Commissioner with
independent verification that the deletion had taken place effectively;
(d) in the meantime, ensure that such data are
securely stored;
(e) proceed with the internal review on procedures
and the external independent review of the software that was used in
the Street View operation and share with the public the results of such
reviews;
(f) ensure all future operations in Hong Kong will
fully comply with the requirements of the Personal Data (Privacy)
Ordinance.
5. Google has been asked and is expected to sign a written Undertaking to the Commissioner incorporating the above proposal. The Commissioner had in fact commenced a compliance check on Google. The signing of an Undertaking shall not affect the continuation of the compliance check.
6. Mr Woo said, “Google through its representative assured me that it will not allow similar incidents to happen in the future, will adopt prompt remedial action and review the Street View operation. I did not leave any doubt as to my strict insistence that Google must fully comply with the privacy law in place in Hong Kong.”
END