Privacy commissioner finds Google broke law by stealing WiFi data

The Australian Privacy Commissioner has found that internet search giant Google broke the law by obtaining data from private WiFi networks through its Street View cars, but no sanctions will be given.

Instead, the company has issued an official apology on its blog and has agreed to several written undertakings that it will undertake a privacy impact assessment and report its findings to the commissioner.

However, special minister of state Joe Ludwig has told The Australian  this morning the privacy commissioner will now be given the ability to hand out sanctions for dire breaches of privacy.

In a statement, commissioner Karen Curtis said she had completed her investigation and that “on the information available, I am satisfied that any collection of personal data breached the privacy act”.

“On the information available I am satisfied that any collection of personal information would have breached the Australian Privacy Act.”

“Collecting personal information in these circumstances is a very serious matter. Australians should reasonably expect that private communications remain private.”

Google has already published an official apology on its blog, but it has also agreed to undertake investigations of any other data collected through its Street Car fleet and provide findings to the commissioner.

“These steps will ensure Google’s future products have privacy protections built in rather than bolted on. Google’s undertakings will last for three years. These undertakings will be reviewed following any reforms to the Privacy Act.”

“Under the current Privacy Act, I am unable to impose a sanction on an organisation when I have initiated the investigation. My role is to work with the organisation to ensure ongoing compliance and best privacy practice.”

Curtis also said she would not comment in detail regarding any other investigations being conducted by other authorities. It is understood the Australian Federal Police is conducting its own investigation.

On its official blog, Google senior vice president of engineering and research, Alan Eustace, said that the company did not want and hadn’t used the data it collected, but says it is “sincerely sorry”.

“We want to reiterate to Australians that this was a mistake for which we are sincerely sorry. Maintaining people’s trust is crucial to everything we do and we have to earn that trust every single day. We are acutely aware that we failed badly here.”

Eustace said the company will comply with the commissioner’s findings, and that it will work “even more closely” to keep in line with privacy regulations.

Meanwhile, Ludgwig says new amendments to the Privacy Act will allow the commissioner to hand out sanctions.

“There will be serious sanctions,” he said. “It is essential we have a robust system in place to protect the privacy of individuals.”