FTC ends Google ‘Spy-Fi’ breach probe

The Federal Trade Commission (FTC) told Google Wednesday it will end its probe into a major privacy breach in which the company collected and stored private user information, such as passwords and entire e-mails, without even realizing it.

David Vladeck, director of the FTC consumer protection bureau, said the
agency will end its inquiry because Google has promised to
improve its privacy practices. Still, Vladeck said the incident shows that Google’s internal review processes are “not adequate.”

{mosads}Google admitted last week in a blog post that it inadvertantly gathered user information from public Wi-Fi networks through its Street View cars, which traverse cities taking pictures of neighborhoods for the Google Maps applications. The company blames glitchy software for the breach.

The company promised to improve its privacy efforts and said it will delete and never use the data.

“Because of these commitments, we are ending our inquiry into this matter at this time,” Vladeck wrote in a letter to Google.

Other privacy promises from Google that assuaged the FTC’s concerns, according to the letter, include “appointing a director of privacy for engineering and product management; adding core privacy training for key employees; and incorporating a formal privacy review process into the design phases of new initiatives.”

Still, Vladeck questioned what kind of lapse in internal review processes could allow Google to collect such information without even noticing.

He said that the company did not discover it was encroaching on user privacy until it was contacted by authorities.

“This indicates that Google’s internal review processes — both prior to the initiation of the project to collect data about wireless access points and after its launch — were not adequate to discover that the software would be collecting payload data, which was not necessary to fulfill the project’s business purpose,” he wrote.

Strong review processes are needed to “identify risks to consumer privacy,” he said.

Google should implement “reasonable procedures” to address these issues, he added, including “collecting information only to the extent necessary to fulfill a business purpose, disposing of the information no longer necessary to accomplish that purpose, and maintaining the privacy and security of information collected and stored.”

Vladeck noted that the FTC has undertaken a review of its own approach to consumer privacy. It is expected release a major report this year.

“A related concern was that companies are storing consumer data for longer periods (at lower cost) and will find new uses for it that consumers may not have contemplated at the time of collection,” he said of the FTC privacy review.