Google has been required by the UK’s Information and Commission Officer to delete the personal data which has been ‘accidentally collected’ by its Street View cars ‘as soon as possible’. Some versions of this story (including the earlier version of this BBC online report) report that this deletion process could take ‘up to nine months‘, although other versions report that the nine-month period refers to the period within which there will be an ICO audit into Google’s internal privacy structure.
Nine months is – quite evidently – far too long a time period for Google to delete this – apparently innocently collected and absolutely unwanted – data: but that’s not my point here. An open ICO investigation into Google’s ‘internal privacy structure’ is surely a report worth reading, but it’s the quotes in the BBC story that worry me; and I don’t just mean the apparent weakness of UK law in this area based as it is on there having to be ‘substantial damage or distress to individuals’.
The ICO has conducted only a basic investigation (in its own view, if it had spent more time searching, it ‘would have found more’). The ICO reported initially that there had been ‘no significant breach’ of the law had occurred, before changing this (to remove the negative) once the Canadian data commission had conducted its investigation. Not only has it has based its decision ‘on the findings of other data authorities’, but it is apparently only able to investigate companies that have actually given it permission to do so.
This is – indeed – a shocking state of affairs. I’m all for international co-operation on these things and – aside of the different legal frameworks that apply – there’s nothing wrong with one data commission taking a lead on investigations and reporting findings that are internationally persuasive. Well done to the Canadian, and the German, authorities in this regard: a welcome sign of the benefits of internationalisation.
But is this not a desperately depressing admission of defeat from an organisation with no power and absolutely starved of sufficient resources to do the job it is supposed to do? And that’s before planned UK government cuts start to hit. If the currently constituted ICO is unable to mount a proper investigation into organisations that it suspects of breaches of the law, what future for other UK governmental organisations charged with responsibility for implementing the law once the cuts really start to bite? The Health and Safety Commission, for example – will it, in the future, be reliant on Canadian bodies to carry out research into substances which may cause damage to workers’ health? And how many other UK authorities will be forced to adopt the view that ‘It is not a good use of the… authority to duplicate more in-depth enquiries’, thus giving themselves a back seat, secondary role in investigations? And what happens to effective regulation in this country when the bodies charged with such tasks are profoundly reliant on others as a result of having insufficient resources to do the job themselves?
Take a glimpse into the future as revealed by the cuts planned by this coalition government – second class, mean and ultimately ineffectual. And fear for the regulatory outcomes.