2. Mr. Chiang explained, “From a privacy and data protection perspective, our concerns, inter alia, have been:-
(a) No opt-out options to users for combining their account data - Not all users would feel comfortable to allow Google to combine their personal data across multiple Google services, especially those users who use Google services for personal and professional purposes. Users should be allowed to opt-out of the arrangement. Google should enable and educate users on how they may maintain separate identities when using Google services.
(c) Effects to Android users - Android users are greatly affected as they have to log on Google in order to meaningfully use Android. Google should provide more details to this group of users on how the change affects them.”
3. PCPD has directly clarified with Google US on the changes. Some notable clarifications are:
(a) No combining information across multiple accounts – Google confirmed that it does not combine information across different accounts even if they have the same registration details (such as name, gender, date of birth), created/accessed from the same computer. It also confirmed that the only change was to allow sharing of information collected in search engine and YouTube with other Google services;
(b) User can create and use multiple Google accounts - Google confirmed that many of its services3; support the switching between logged in accounts;
(c) Coverage of the combined policy – Google confirmed that the combined policy applies to all Google services without exception. However, in addition to the combined policy, the following products have additional privacy policies: Chrome and Chrome OS, Books and Wallet;
(d) Clarification on sharing information – Google confirmed that they would only share user information to external parties with the user’s consent (e.g. Google+ users having shared their postings to the public on one occasion would be taken as giving consent, by default, to share their subsequent postings).
5. “In terms of fully addressing the privacy concerns we have raised, we are far from satisfied with Google’s clarifications and improvements done. For example, up to now, we are still unable to obtain detailed information from Google on what and how information stored in Android phones would be accessible and shared by Google,” Mr. Chiang commented.
6. Hong Kong’s concerns are shared by the Privacy Commissioners, Data Protection Authorities and consumer groups worldwide. In particular, the French CNIL, on behalf of the European Union data protection authorities, has commenced an investigation into the lawfulness and fairness of Google’s aggregation of users’ personal data across services.
7. “To seek Google’s further improvement in personal data protection, PCPD will continue to co-operate with other APPA members in confronting Google. We will also keep in view and capitalize on the investigative efforts of CNIL,” Mr. Chiang pointed out.
8. While the enquiry with Google is still on-going, PCPD’s advice to Google users in the meantime is as follows:-
(a) if they are concerned about their information collected by Google, they should visit the Dashboard (www.google.com/dashboard) to examine what account and profile information are stored by Google, particularly search records in Web history and YouTube history, and removing/pausing them accordingly;
(b) if they wish to opt-out from Google advertisements that are based on the users’ interests and demographic details, they should access the Ad Preference Manager (www.google.com/ads/preferences) to inspect/modify/remove the categories Google has assigned to them for advertising purposes, and consider to download a browser plug-in from this page;
(c) if they are concerned about Google mixing together the information related to their personal, work or other affairs, they should consider creating multiple Google accounts to manage these activities; and
(d) if they are Android users concerned about the storage of location history by Google and sharing the information with other services, they should consider (i) disabling various options under Location services when not in use, and (ii) erasing and disabling Latitude location information in the Dashboard.
1 The new policy, which commenced on 1 March 2012, has consolidated the different privacy policies that previously applied to Google’s respective products and services (over 70). The move would facilitate Google to combine the data of a subscriber using multiple Google products (such as Gmail, YouTube, Google+, Maps, Search and Android), provided in very different contexts and for very different reasons, into a single merged profile. Google pointed out that the change would create a simpler, more intuitive user experience across multiple Google products; improve search results; and make ads more relevant.
2 Asia Pacific Privacy Authorities (APPA) is the principal forum for privacy authorities in the Asia Pacific Region to form partnerships and exchange ideas about privacy regulation, new technologies and the management of privacy enquiries and complaints. APPA members include data protection authorities from Australia, Canada, Hong Kong, Macao, Mexico, New Zealand, South Korea and the United States.
3 A list of these services is available at http://support.google.com/accounts/bin/answer.py?hl=en&answer=1721977&topic=2373242