Wednesday, September 19, 2007

Eric Schmidt on Global Privacy Standards

Eric Schmidt, Google's CEO, added his voice to the debate on global privacy standards with this OpEd, published in a number of outlets around the world this week.

As the information age becomes a reality for increasing numbers of people globally, the technologies that underpin it are getting more sophisticated and useful. The opportunities are immense. For individuals, a quantum leap forward in their ability to communicate and create, speak and be heard; for national economies, accelerated growth and innovation.

However, these technological advances do sometimes make it feel as if we are all living life in a digital goldfish bowl. CCTV cameras record where we shop and how we travel. Mobile phones track our movements. Emails leave a trail of who we “talk” to, and what we say. The latest internet trends - blogs, social networks and video sharing sites - take this a step further. At the click of a mouse it’s possible to share almost anything – photographs, videos, one’s innermost thoughts - with almost anyone.

That's why I believe it's important we develop new privacy rules to govern the increasingly transparent world which is emerging online today – and by new rules I don’t automatically mean new laws. In my experience self regulation often works better than legislation – especially in highly competitive markets where people can switch providers simply by typing a few letters into a computer.

Search is a good example. Search engines like Google have traditionally stored their users’ queries indefinitely – the data helps us to improve services and prevent fraud. These logs record the query, the time and date it was entered, and the computer’s Internet Protocol (IP) address and cookie. For the uninitiated, an IP address is a number (sometimes permanent, sometimes one-off) assigned to a computer – it ensures the right search results appear on the right screen. And a cookie is a file which records people’s preferences - so that users don’t continually have to re-set their computers.

While none of this information actually identifies individuals, it doesn’t tell us who people are or where they live, it is to some extent personal because it records their search queries. That’s why Google decided to delete the last few digits of the IP address and cookie after 18 months – breaking the link between what was typed, and the computer from which the query originated. Our move created a virtuous dynamic, with others in the search industry following suit soon afterwards. In an industry where trust is paramount, we are now effectively competing on the best privacy practices as well as services.

Of course, that’s not to say privacy legislation doesn’t have its place in setting minimum standards. It does. At the moment, the majority of countries have no data protection rules at all. And where legislation does exist, it’s typically a hotchpotch of different regimes. In America, for example, privacy is largely the responsibility of the different states – so there are effectively 50 different approaches to the problem. The European Union by contrast has developed common standards, but as the UK’s own regulator has acknowledged these are often complex and inflexible.

In any event, privacy rules in one country, no matter how well designed, are of limited use now that personal data can zip several times around the world in a matter of seconds. Think about a routine credit card transaction – this can involve six or more separate countries once the location of customer service and data centres are taken into account.

The lack of agreed global privacy standards has two potentially damaging consequences. First, it results in the loss of effective privacy protections for individuals. How can consumers be certain their data is safe, wherever it might be located? Second, it creates uncertainty for business, which can restrict economic activity. How does a company, especially one with global operations, know what standards of data protection to apply in all the different markets where it operates?

That’s why Google is today calling for a new, more co-ordinated approach to data protection by the international community. Developing global privacy standards will not be easy – but it’s not entirely new ground. The Organization for Economic Co-operation and Development produced its Guidelines on the Protection of Privacy and Trans-border Flows of Personal Data as far back as 1980.

More encouragingly recent initiatives in this area by the United Nations, the Asian-Pacific Economic Co-operation Forum and the International Privacy Commissioners’ Conference have all focussed on the need for common data protection principles. For individuals such principles would increase transparency and consumer choice, helping people to make informed decisions about the services they use as well as reducing the need for additional regulation. For business, agreed standards would mean being able to work within one clear framework, rather than the dozens that exist today. This would help stimulate innovation. And for governments, a common approach would help dramatically improve the flow of data between countries, promoting trade and commerce.

The speed and scale of the digital revolution has been so great that few of us can remember how life was before we had the ability to communicate, trade or search for information 24-hours a day, seven days a week. And the benefits have been so great that most people who do recall our analogue past would never want to return to the old days. The task we now face is twofold: to build trust by preventing abuse and to enable future innovation. Global privacy standards are central to achieving these goals. For the sake of economic prosperity, good governance and individual liberty, we must step up our efforts to implement them.

1 comment:

Ann Cavoukian said...

URGENT

September 21, 2007

Peter Fleischer
Global Privacy Counsel
Google Inc.
1600 Amphitheatre Parkway
Mountain View, CA 94043 U.S.A.

Dear Mr. Fleischer:

Re: Internet Privacy Standards Required

I recently read with great interest two articles about Google and privacy, one from the Washington Post (September 15th) and the second in the Financial Times (September 20th). Both articles referred to Google’s call for international standards on privacy. Let me first commend Google for taking this public stand in favor of global standards. I would also like to draw your attention to documents already produced by highly regarded international authorities on privacy and suggest that the issue is not one of developing new standards, but of raising the bar by observing existing global standards and privacy principles.

Two years ago, at the 27th Conference of the International Data Protection Commissioners in Montreux, Switzerland, I chaired a working group of Commissioners convened for the purpose of creating a single harmonized privacy standard. After significant work, we were able to identify the best elements of privacy principles from around the world and harmonize them into a single instrument. I believe that this is one of the standards you referred to in your Financial Times piece. This “Global Privacy Standard” builds upon the strengths of existing codes containing time-honored privacy principles and, for the first time, explicitly recognizes the concept of “data minimization” under the collection limitation principle. It was formally tabled and accepted in the United Kingdom, on November 3, 2006, at the 28th International Data Protection Commissioners Conference. Below please find a link to a copy of the Global Privacy Standard letter, for your information.

The need for privacy protection has never been more urgent, as you have stated. Identity theft is probably the most publicized risk on the Internet these days. As you well know, the Internet was not designed to protect identity information. This missing identity layer is a barrier to trust which can prevent customers and citizens from taking advantage of services that are made available to them. In response, last year, my office released “The 7 Laws of Identity: The Case for Privacy-Embedded Laws of Identity In the Digital Age,” to make it easier for technology companies to build privacy into their products, using guidance such as the second law: Minimal Disclosure for Limited Use: Data Minimization. I am also attaching a copy of this document.

It struck me that the issue was not one of developing another global standard – that work has already been done. Rather, the challenge is in the execution – how to transform the practice of companies and organizations already engaged in the collection, use and disclosure of personal information on the Web. I believe that this transformation is what you were referring to and is reflected in Google’s “Do No Evil” motto. Please feel free to contact me if I can be of any assistance in regard to this transformation. Nothing could be of greater significance to Internet privacy and customer trust than establishing a safe minimum ‘floor’ of privacy, as represented by the Global Privacy Standard and the privacy-embedded laws of identity. If Google were to adopt these principles, it would represent an enormous step forward for global privacy protection. Their general adoption and reflection in practice will raise the bar for all companies. It may also give companies that “do no evil,” a competitive advantage.

If you have any questions, I would be happy to discuss this with you.

Sincerely yours,
Ann Cavoukian, Ph.D.
Commissioner

Links:
(1) Global Privacy Standard
http://www.ipc.on.ca/index.asp?navid=46&fid1=575
(2) 7 Laws of Identity
http://www.ipc.on.ca/index.asp?navid=46&fid1=470