Skip to content

Media Statements

Media Statements

Date: 26 July 2012

Privacy Commissioner reports improvements in Google's new privacy policy

1. At a press briefing today (26 July 2012), the Privacy Commissioner for Personal Data, Mr. Allan Chiang, reported some improvements in Google’s new privacy policy 1subsequent to the dialogue and exchange of correspondence that his Office (“PCPD”) had with Google since February 2012. The success represented the efforts of multi-jurisdictions on data protection, with Hong Kong acting as the convenor of the Technology Working Group (“TWG”) of the Asia Pacific Privacy Authorities (“APPA”)2 .

2. Mr. Chiang explained, “From a privacy and data protection perspective, our concerns, inter alia, have been:-

(a) No opt-out options to users for combining their account data - Not all users would feel comfortable to allow Google to combine their personal data across multiple Google services, especially those users who use Google services for personal and professional purposes. Users should be allowed to opt-out of the arrangement. Google should enable and educate users on how they may maintain separate identities when using Google services.

(b) Readability of privacy policy should not be at the expense of details - The unified Google privacy policy becomes so high-level that it is hard for users to know what information is being shared, how and why (especially when one only registers for a few of Google’s services). Furthermore, certain details in the previous policies (such as the time commitment to honour an erasure request) appear to have been left out in the new policy.

(c) Effects to Android users - Android users are greatly affected as they have to log on Google in order to meaningfully use Android. Google should provide more details to this group of users on how the change affects them.”

3. PCPD has directly clarified with Google US on the changes. Some notable clarifications are:

(a) No combining information across multiple accounts – Google confirmed that it does not combine information across different accounts even if they have the same registration details (such as name, gender, date of birth), created/accessed from the same computer. It also confirmed that the only change was to allow sharing of information collected in search engine and YouTube with other Google services;

(b) User can create and use multiple Google accounts - Google confirmed that many of its services3; support the switching between logged in accounts;

(c) Coverage of the combined policy – Google confirmed that the combined policy applies to all Google services without exception. However, in addition to the combined policy, the following products have additional privacy policies: Chrome and Chrome OS, Books and Wallet;

(d) Clarification on sharing information – Google confirmed that they would only share user information to external parties with the user’s consent (e.g. Google+ users having shared their postings to the public on one occasion would be taken as giving consent, by default, to share their subsequent postings).

4. PCPD also noted that some improvements in Google’s new privacy policy have been made. For example, there are now more ways to access privacy-related information. Also, as a response to customers’ wish to opt out of data combination across multiple services, Google allows multiple accounts to be used simultaneously in some of its services (such as Gmail and iGoogle).

5. “In terms of fully addressing the privacy concerns we have raised, we are far from satisfied with Google’s clarifications and improvements done. For example, up to now, we are still unable to obtain detailed information from Google on what and how information stored in Android phones would be accessible and shared by Google,” Mr. Chiang commented.

6. Hong Kong’s concerns are shared by the Privacy Commissioners, Data Protection Authorities and consumer groups worldwide. In particular, the French CNIL, on behalf of the European Union data protection authorities, has commenced an investigation into the lawfulness and fairness of Google’s aggregation of users’ personal data across services.

7. “To seek Google’s further improvement in personal data protection, PCPD will continue to co-operate with other APPA members in confronting Google. We will also keep in view and capitalize on the investigative efforts of CNIL,” Mr. Chiang pointed out.

8. While the enquiry with Google is still on-going, PCPD’s advice to Google users in the meantime is as follows:-

(a) if they are concerned about their information collected by Google, they should visit the Dashboard (www.google.com/dashboard) to examine what account and profile information are stored by Google, particularly search records in Web history and YouTube history, and removing/pausing them accordingly;

(b) if they wish to opt-out from Google advertisements that are based on the users’ interests and demographic details, they should access the Ad Preference Manager (www.google.com/ads/preferences) to inspect/modify/remove the categories Google has assigned to them for advertising purposes, and consider to download a browser plug-in from this page;

(c) if they are concerned about Google mixing together the information related to their personal, work or other affairs, they should consider creating multiple Google accounts to manage these activities; and

(d) if they are Android users concerned about the storage of location history by Google and sharing the information with other services, they should consider (i) disabling various options under Location services when not in use, and (ii) erasing and disabling Latitude location information in the Dashboard.

1 The new policy, which commenced on 1 March 2012, has consolidated the different privacy policies that previously applied to Google’s respective products and services (over 70). The move would facilitate Google to combine the data of a subscriber using multiple Google products (such as Gmail, YouTube, Google+, Maps, Search and Android), provided in very different contexts and for very different reasons, into a single merged profile. Google pointed out that the change would create a simpler, more intuitive user experience across multiple Google products; improve search results; and make ads more relevant.

2 Asia Pacific Privacy Authorities (APPA) is the principal forum for privacy authorities in the Asia Pacific Region to form partnerships and exchange ideas about privacy regulation, new technologies and the management of privacy enquiries and complaints. APPA members include data protection authorities from Australia, Canada, Hong Kong, Macao, Mexico, New Zealand, South Korea and the United States.

3 A list of these services is available at http://support.google.com/accounts/bin/answer.py?hl=en&answer=1721977&topic=2373242

END