PI files complaint about Google Street View

Privacy International

23/03/2009

Mr Richard Thomas
Information Commissioner
The Office of the Information Commissioner,
Water Lane,
Wycliffe House,
Wilmslow, Cheshire SK9 5AF
UNITED KINGDOM

Dear Mr. Thomas,

Complaint: Google Street View technology

I am writing on behalf of a large number of complainants to Privacy International with regard to the "Street View" system that has been deployed by Google in the past few days.

We are aware that you have given a green light to the product on the basis of assurances provided by the company. However we believe that these promised safeguards in Street View's technology (i.e. the automatic blurring of faces) have not performed to the extent that Google had indicated. Moreover, given the clear embarrassment and damage that some of these images have caused it is in our view entirely unacceptable to address data protection concerns by way of notice and take-down of images. Accordingly, it is our view that Street View violates the Data Protection Act and we ask that you take immediate action to prevent further encroachments on the core principles of the Act.

In summary, we believe on the basis of complaints received, that the service has created numerous instances of embarrassment and distress and that the promised privacy safeguards do not provide adequate protection to shield Street View from the general requirement to provide notice prior to collection of the data. We also believe that the technology has created substantial threat to a number of individuals and that the extent of intrusion into the homes of some complainants is unlawful. In such cases, Google should have acquired consent from individuals before images were captured.

Background

This matter has been the subject of correspondence between Privacy International and Google from as far back as May 2008.

On 2nd July I wrote to Jane Horvath, Google's Senior Privacy Counsel, expressing Privacy International's concerns about the "face blurring" technology that had been promoted by the company:

(W)hen we requested information from Google six weeks ago about the specifications for this technology your colleagues admitted that there were problems with it at an engineering level.
We are concerned that claims of protection are being made that may not be possible to institute. I am writing to request full disclosure of the technology specifications for the promised face and numberplate blurring system so that the public can be assured that Google has taken every step necessary to satisfy not just legal requirements, but that it is also fulfilling its stated commitments.
You will know hat we have often complained that Google performs poorly on the issue of transparency. I believe this is one occasion where disclosure is crucial. Public trust in Google will suffer if there is a perception that the company is manipulating the facts.
I ask that you respond with this technical information within seven days. I also ask that you inform us of the steps, if any, that you have taken to consult the public over the use of their images for what is, in effect, a commercial purpose.

Google responded on 5th July, stating:

As with all such systems operating at this scale our blurring technology is not perfect - we occasionally miss a face or license plate, for example if they are partially covered, or at a difficult angle. However, we tested the technology thoroughly before launch and I am confident that it finds and blurs the vast majority of identifiable faces and license plates. For the few that we miss, the tools within the product make it easy for users to report a face or license plate for extra blurring. As always, users can still ask for their image to be removed from the product entirely. We'll also keep working hard to make sure that the technology continues to get even better.
I strongly believe that this type of privacy-enabling technology, together with effective controls for users, is the best way of meeting the challenge of respecting people's expectation of privacy without stifling the development of new products and services that everyone can enjoy and benefit from. We have already been working with the relevant privacy regulators and groups in different countries in which we will offer Street View, including the UK. You may already be aware that Thursday's Tour de France launch was warmly welcomed by CNIL, the French data protection authority.
I'm sure you will understand that I cannot share the proprietary specifications for the technology which we have developed, but I believe that the results clearly demonstrate our commitment to provide practical and transparent privacy solutions.

On 7th July I again wrote to Google, expressing our disappointment with its response:

The reason we asked for technical specs for Street View face blurring (and hopefully more quantifiable information) was to ensure that everyone could be assured that the system worked to a reasonable expectation, and that there would not be circumstances, perhaps unforeseen, that might lead to exposure. We do understand your concerns about proprietary aspects. Nevertheless, this should not prevent publication of a more expansive overview of the system and the details of any trials that it has undergone. We are not, after all, asking for Open Source access.

It was clear to us throughout this chain of correspondence that Google had either not bothered to quantify its claims, or it had no intention of releasing research data.

We also contest the assertion that the French Data Protection authority "warmly" welcomed Google's face blurring technology. As far as we understand the situation, CNIL (the authority) warned that while the technology was a step in the right direction, it was still underdeveloped. We agree with CNIL's assessment.

A premature approval

In July 2008 your office issued a statement that asserted:

We are satisfied that Google is putting in place adequate safeguards to avoid any risk to the privacy or safety of individuals, including the blurring of vehicle registration marks and the faces of anyone included in Street View images. Although it is possible that in certain limited circumstances an image may allow identification of an individual, it is clear that Google are keen to capture images of streets and not individuals.

Would you please explain the basis of this assessment? Did Google provide technical specifications or test data relating to the face and numberplate blurring technology? We are anxious to understand precisely how you reached such a positive conclusion at the same time that we could find no basis whatever to support Google's assertions.

I refer to the words used by Google in response to our correspondence. The closest error figure we were given was "a few" misses: "we occasionally miss a face or license plate, for example if they are partially covered, or at a difficult angle."

This assertion appears to be a gross underestimation. A number of UK media organisations have published a substantial number of examples of images in which the face blurring has failed to work, even when people are directly facing Google's cameras. In some cases one face in three is unaffected by the face blurring technology. Additionally, we are unsure of the effectiveness of the blurring even when it 'works'. We continue to receive complaints from the public that they remain recognizable because of other individual characteristics such as location and clothing.

We believe it was entirely inappropriate to publish what in effect became an endorsement of Google's product, more than eight months in advance of its deployment.

The Human face of Street View

More than two hundred members of the public have contacted Privacy International since last Thursday to express concern about specific images on Street View. We believe on the basis of these complaints, that the service has created numerous instances of embarrassment and distress and that the promised privacy safeguards do not provide adequate protection to shield Street View from the general requirement of notice and consent.

To establish the impact that disclosure through Street View has had on individuals, it is important that we set out a selection of the complaints that we have received:

A man (whose face was partially blurred) was recognized by his partner having a cigarette outside his place of work. This has caused distress and dysfunction in the relationship as the man in question had not disclosed to his partner that he enjoyed the occasional cigarette.
A fifteen year-old boy was caught on Street View carrying a skateboard, which his parents had expressly forbade him from using. The boy subsequently had a row with the parents and is now staying with friends.
A married man was captured speaking at close proximity with a female colleague. Because of nearby noisy road works he was forced to speak into her ear, but the image created the appearance of intimacy. This image created a tense argument between the married couple.
A woman who has for several years been moving house to avoid detection from a former violent partner complained to us that she felt extreme distress when Street View identified her outside her new home.
A man complained to us that when he looked up his own home on Street View every numberplate had been blurred other than that of his own car, which was parked directly outside his home. The complainant is now extremely concerned about security implications.
Two men working for a large organization were identified by work colleagues in a situation which gave the appearance that they were kissing each other. This was not the case, but the image - subsequently widely circulated throughout the organization - has caused great humiliation to them and their (female) partners.
A woman was captured leaning out of her loungeroom window in the company of a man. The woman's husband discovered the image and confronted his wife, demanding an explanation of her apparent "affair". It transpired that the man was a contractor, and the woman was discussing a quote for exterior painting work. The argument was swiftly resolved, but the couple is still extremely distressed about the situation.

The basis of this complaint

We are deeply concerned that approval for Street View has been given on the basis of unquantifiable assertions about the effectiveness of the blurring technology and offers by Google to take down the offending images.

We believe it is not the intention of the law nor the business of a regulator to play Russian Roulette with the rights of individuals. If the rights of the few are to be inevitably compromised, then the system in question should not be deployed. While we accept that some latitude should be given to organizations developing new technologies (particularly with regard to unintended consequences), there is no excuse in our view for deploying a technology that has an anticipated wide margin of failure.

Despite the substantial number of complaints received by Google a company spokesperson asserted that the number was "less than expected" (Daily Telegraph, March 20, 2009).

Equally, if the onus is placed on the individual after an offending image has been published to take steps to remedy the situation, the core purpose of the Data Protection Act will have been defeated.

We believe that with regard to data protection compliance, the standards applying to lawful deployment of technology should be as robust as those applying to health and safety or environmental protection. This is certainly not the situation that is being considered in the case of Street View.

We assume, on the basis of the ICO advice (for example in the 2008 CCTV Code of practice) that anyone who can be identified (whether by way of facial characteristics or other qualities, clothing or behaviour) constitutes personal information under the Data Protection Act.

Consent

The promise to blur faces and numberplates subsequent to capture of the data is a red herring. Were it to be the case that personal information is allowed to be collected without consent on the basis of promises to subsequently delete or modify the data, the entire basis of legal controls over data collection would be fatally circumvented.

Why, under this reasoning, should not all commercial organizations be permitted to collect limitless volumes of personal data without consent on the promise that specific items of data will be removed on request? Is this the new legal guidance for supermarkets, banks and hotels?

It is equally the case, on the basis of complaints received, that individuals may be identified even if the face is blurred. We call into question the reasoning that images captured by Street View constitute personal data only if the face is identifiable.

In the case of Street View, we assert that the process of capturing the image per se is unlawful. I do not need to remind you that data protection has particular regard to personal data that can be indexed and cross-matched. This is certainly the case with Street View. This system cannot in any way be compared with random or incidental images capture by mobile phone cameras, nor can it be likened to CCTV, which enjoys limited exception on the basis of crime prevention and detection.

Street View and breach of the CCTV Code of Practice

We assert that many of the conditions that apply to use of CCTV technology should also apply to Street View. While we accept that there are certain differences between the two technologies, there is also substantial intersection, particularly with regard to the potential for intrusion.

The 2008 ICO Code contains a number of requirements that are not met by Street View. With regard to positioning of cameras:

Both permanent and movable cameras should be sited and image capture restricted to ensure that they do not view areas that are not of interest and are not intended to be the subject of surveillance, such as individuals' private property. (Section 6)

We assume, though it is not made explicit in the Code, that this condition refers to intrusion into the interior of people's homes and gardens. If this is indeed the case then Google has comprehensively breached the Code and the Data Protection Act. No consent was sought for the capture of such images, little or no meaningful notice was given and there is no public interest in such intrusion.

The Code also advises: "You must let people know that they are in an area where CCTV surveillance is being carried out."

The most effective way of doing this is by using prominently placed signs at the entrance to the CCTV zone and reinforcing this with further signs inside the area. This message can also be backed up with an audio announcement, where public announcements are already used, such as in a station.

Notification by way of media coverage is clearly not an acceptable form of notice provision.

We are also concerned about the extent to which Google can comply with two additional conditions, as set out in the Code:

Staff operating the CCTV system also need to be aware of two further rights that individuals have under the DPA. They need to recognise a request from an individual to prevent processing likely to cause substantial and unwarranted damage or distress (s10 DPA) and one to prevent automated decision-taking in relation to the individual (s12 DPA).

Exceptional threat to vulnerable people

Amongst the most harrowing complaints received by Privacy International have been those from women who are living in fear of violent former partners and stalkers.

We do not feel it should be necessary to remind the Information Commissioner of the importance of protecting people who are in this terrible situation, or of the sensitivity that "ordinary" personal data can acquire in such situations. However to emphasise the serious nature of these complaints, and the potential grave consequences, we have decided to include here a part of one of these complaints, with most details and stylistic characteristics removed:

After horrific experiences in a marriage I am now divorced. Restraining orders did nothing to prevent or alleviate the situation, so i ran away.
Over a period of a few years i moved from place to place in an attempt to cover my tracks and make it that much harder to be tracked down, always looking over my shoulder for fear of my ex partner. Forgive me but unless one has lived through such experiences, they cannot fully grasp the full fear nor how determined some ex partners can be.
The journey to protect myself and my children has taken some 5 years to get to where we are now, I have begun to feel a little more "safe" in the area I live, i suffer fewer nightmares, less panic attacks when out, although the fear never completely dissipates it has lessened to the degree that my general health is improving. It only takes one captured image of me for my ex to pursue the rabid hunt with more gusto than ever before,
There are many hundreds of people just like me, who are attempting to piece their lives back together again, who desperately need, as i do, to feel safe.

Finally, we would also like to raise the prospects for the interference with the private life when the individual's home is in clear view, particularly when that view is more privileged than it would be had a casual passer-by merely looked in. We have received numerous complaints from individuals who claim that Street View could let burglars see into their private properties.

Failure to consult

In our July 2nd letter to Google we said: "I also ask that you inform us of the steps, if any, that you have taken to consult the public over the use of their images for what is, in effect, a commercial purpose".

This point was not addressed in Google's subsequent response. We observed in our letter of July 7th:

The email response from your PR team also avoided dealing with the issue of public consultation, which as you know, is a matter we have differed on for some time. This goes to the heart of the trust issue that Privacy International has consistently raised.

We believe that in circumstances such as those surrounding Street View consultation with the Information Commissioner does not constitute an adequate consultation. If Google had reached out to the populations and communities it intended to capture, at least some of the eventual privacy problems may have been identified and possibly remedied.

Conclusion

We accept that these facts constitute a very complex legal challenge but we are confident that the Street View system must be regarded as operating outside the law until such time as these matters are resolved. We urge you to require Google to remove all images until we have achieved clarity on the application of the Data Protection Act and further clarification of the true impact of Google's technology on the rights of individuals.

Privacy International believes that the steady encroachment by organisations into the private lives of individuals has come about in part because of the sort of pragmatic regulation that has been demonstrated in the case of Street View. It is time, in our view, to reform the consultation and approval process adopted by your office in line with community expectations and best practice.

Yours sincerely,

Simon Davies
Director
Privacy International

<< Back

Email us at privacyint@privacy.org.
Call on +44 (0)208.123.7933.
Privacy Policy - About PI - Support PI