Google’s New Privacy Policy: Close But No Cigar

By Adam Levin via BoingBoing.net

Last week was a pretty good one for the notion of privacy in America, which has increasingly become forlorn and tattered as a result of the advancement of digital technology. First, the Supreme Court ruled in United States v. Jones that warrantless GPS tracking of a criminal suspect by the FBI was unconstitutional, and then later in the week Google announced its new privacy policy, a model of simplicity and fairness with one sizeable flaw. Oddly, this particular decision by the court sheds some important light on the particular problem within Google’s otherwise admirable new privacy policy.

The decision of the Court in United States v. Jones was accompanied by two concurring opinions, one written by Justice Alito, and the other by Justice Sotomayor. The unanimous decision and ruling found that the government violated the Fourth Amendment’s prohibition of unreasonable searches and seizures because a tracking device had been attached to the defendant’s car without first obtaining a warrant. The placing of the device constituted a trespass, akin to breaking into someone’s home or filing cabinet.

Justice Alito’s well-reasoned concurrence went further, arguing that the notion of physical trespass as a predicate to finding a warrant necessary was outdated, and that beginning with the wiretapping cases of the 1960s, courts began to recognize that a more appropriate standard was whether or not a person had “a reasonable expectation of privacy” in a given situation. This approach, argued Alito, was far more effective in dealing with privacy issues in the digital era—as opposed to limiting the Fourth Amendment to the law of trespass, which essentially dates back to 1215. Justice Sotomayor’s opinion spoke to the world as we know it, and she couldn’t have been more spot on. She wrote:

… it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy in information voluntarily disclosed to third parties… This approach is ill-suited to the digital age, in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks. People disclose the phone numbers that they dial or text to their cellular providers; the URLs that they visit and the e-mail addresses with which they correspond to their Internet service providers; and the books, groceries, and medications they purchase to online retailers… I for one doubt that people would accept without complaint the warrantless disclosure to the Government of a list of every Web site they had visited in the last week, or month, or year.”

Justice Sotomayor separates the notion of intrusion from that of physical trespass while simultaneously untangling the often-confused ideas of privacy and secrecy. Why should anyone expect that the information that a customer has to provide to their bank will be made available to the Government without a Court-issued warrant? Absent that warrant, anything you intend to keep private should be kept private. Justice Sotomayor cited the decision in the 1967 case of Katz v. United States “[W]hat [a person] seeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.” Justice Sotomayor’s logic preserves the sanctity of the Fourth Amendment in the context of the massive flow of digital information available on the Internet today, and as such, it is a very important opinion. However, the Fourth Amendment restricts only what the government can do; it bears no relation to the activities or policies of individuals or organizations. There are plenty of other laws that in one way or another seek to protect the privacy of personal information from misuse by the private sector, but the best protection an individual can have is the attitude and policy of the entity to whom one’s information is voluntarily entrusted. Happily, but slowly, major players on the web are taking steps to protect your privacy, or at least to let you know just how and why it can be forfeit. So last week’s announcement by Google (probably the largest collector of information on the planet, outside of Beijing) regarding privacy is not only important, but very timely in light of the Court’s decision in the Jones case.

Google’s new policy is exemplary in its brevity, comprehensibility, and candor. If you disagree, try reading one from a bank or a wireless carrier (emphasis on the word “try.”) In simple language, it sets forth—among other items—the kinds of information being collected, how Google and its associates may use that information, and what you can do to limit that usage. It really does tell you everything you need to know, for better or for worse, and as compared to the policies and procedures of other information collectors, it seems reasonable and fair-minded. It does, however, embody one glaring mistake, best illuminated by the light of Justice Sotomayor’s concurring opinion.

Contained in the “Information Sharing” section there are assurances that information provided to Google will be shared with third parties only in limited circumstances. Google lists four circumstances, the first one being when, “We have a good faith belief that access, use, preservation or disclosure of such information is reasonably necessary to (a) satisfy any applicable law, regulation, legal process or enforceable governmental request…”

Hold on, Bucky.

What exactly constitutes an “enforceable governmental request?” This sentence should read: “We will share information with a Governmental entity only when presented with a valid search warrant issued by a court of competent jurisdiction.” Such a provision would make it obvious that by giving information to Google, you do not intend to waive your constitutional rights, and it would make it clear that despite the fact that your information was shared willingly with a private sector entity, you reasonably retained an expectation of privacy against Government intrusion. If everyone’s privacy policy had language of this type, sooner or later every court — and every legislature — would remember all that stuff about the Fourth Amendment.

Of course, you may still be dismayed by the fact that Google is able to share your information with anyone at all, whether private or public. Arguably, that is the price we pay for all of the service and convenience that companies like Google provide to us, free of charge. But, that is a conversation we must reserve for another day. The old saw is that the requirement of search warrants makes crime easier for the bad guys. In the Jones case, the defendant was given a life sentence for, among other things, harboring a linebacker-sized cache of cocaine — and that conviction was overturned by the Court’s unanimous decision. And that is the price of freedom.