Originally shared by Eva Schlehahn

Originally shared by Eva Schlehahn

My two cents on Google+

Hi folks! =)

After creating this account here, it took sometime to figure out all of Google+, its functionalities and possibilities. Eloísa V. lured me here and I promised to her to share my first thoughts about this new social network as soon as I can manage it. So here I am. =)

Right at the beginning: tl;dr warning – this thing is awfully long! XD

So let’s get started, shall we?

At first look, the overall design of the website is clear and easy to the eye. The management of circles, the incoming stream of news and posts and sharing is well structured and effortless for any user. Many people already wander off from Facebook, which repeatedly has been in the headlines recently, with more and more emphasis accused of not taking as much care of data protection issues than its users wish for. Even worse, Facebook's newest changes make its compliance flaws related to several data protection frameworks (mostly the European ones) increasingly apparent. Now,with Google+, there is a powerful competitor, drawing much medial attention, especially through the first-mentioned circles, enabling more privacy for Google+ users. But aside from these circles, is Google+ really an option when it comes to data protection and privacy issues? I was intrigued and decided to take a look into the relevant terms of use and privacy policies of Google. In the following, I will try my best to describe my thoughts on these, point out things that deem positive as well as negative. Please note that this is no complete legal analysis of this service, just a personal, quick fun venture into the depths of Google’s data protection compliance efforts.

Okay, here I go – Google has four main documents that are relevant in respect to the topic:

- The general Google Terms of Service
(current version of April 16, 2007)

- The Google Privacy Policy
(current version of October 3, 2010)

- The Google+ Privacy Policy
(current version of June 28, 2011)

- The Google+ Button Privacy Policy
(current version of June 28, 2011)


General Google Terms of Service

The Google Terms of Service regulate the general conditions under which the services provided by Google, including Google+, may be used. You can see the complete text here: http://www.google.com/accounts/TOS

Already at first reading, I stumble upon interesting things. There, under paragraph 8, Google states that

8.3 Google reserves the right (but shall have no obligation) to pre-screen, review, flag, filter,modify, refuse or remove any or all Content from any Service. For some of the Services, Google may provide tools to filter out explicit sexual content. These tools include the SafeSearch preference settings (see http://www.google.com/help/customize.html#safe). In addition, there are commercially available services and software to limit access to material that you may find objectionable.

Whoops, what was that? So I understand this in such a fashion that Google de-facto reserves the right to look up and eventually censor any kind of data I upload through their services, even though it may be by automated means. Apparently, Google uses automated filter software to remove offending content (but does not specify what offending means to them). As for the explicit sexual content, this starkly reminds me of Microsoft’s PhotoDNA, a program designed to undeceive child pornography on public servers, which scans images on disproportional percentage of skin display (http://www.microsoft.com/presspass/presskits/photodna/) The problem here is that such automated processes precondition access to personal data of the customer of which the customer/data subject generally is not aware of. The automated deployment of such filters may also lead to undesired effects, for instance in the case of a photographer who uploaded pictures for his own backup purposes to Skydrive (which uses Microsoft’s tool, just as Facebook does) and got his access blocked without prior notice/consultation (http://www.theunwired.net/?item=surveillance-microsoft-restricted-windows-phone-7-skydrive-access-because-of-uploaded-nudes&utm_source=feedburner&utm_medium=twitter&utm_campaign=Feed:+theunwired+%28the::unwired+-+where+mobility+meets+wireless%29). So there is a big open question how Google’s tool exactly works, to which extent it gives internal access to user’s content (even if not shared with anyone, e.g. in a private folder) and how the company will deal with ambiguous situations like the one described above.

Next one – under paragraph 11,Google states:

11.1 You retain copyright and any other rights you already hold in Content which you submit, post or display on or through, the Services. By submitting, posting or displaying the content you give Google a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive license to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute any Content which you submit, post or display on or through, the Services. This license is for the sole purpose of enabling Google to display, distribute and promote the Services and may be revoked for certain Services as defined in the Additional Terms of those Services.

11.2 You agree that this license includes a right for Google to make such Content available to other companies,organizations or individuals with whom Google has relationships for the provision of syndicated services, and to use such Content in connection with the provision of those services. […]

While I delight over the fact that Google acknowledges the fact that the right to use content should be limited to the purpose of running their offered services smoothly, I am not entirely sure how to read the second paragraph. The term “syndicated services” is vague at best, I am also missing a listing of Google’s affiliates/contract partners who exactly benefit from this regulation.

Okay, let’s see what happens when you stop using Google’s services. Paragraph 13 addresses the termination of service usage:

[…]13.5 When these Terms come to an end, all of the legal rights,obligations and liabilities that you and Google have benefited from, been subject to (or which have accrued over time whilst the Terms have been in force) or which are expressed to continue indefinitely, shall be unaffected by this cessation, and the provisions of paragraph 20.7 shall continue to apply to such rights, obligations and liabilities indefinitely.

Not a single word about what happens with your data once you decide not to use Google’s services any longer. Google leaves it unclear if such data will be deleted after an adequate grace period or if it just will continue to collect dust on Google’s servers. Alright, let’s take a brief look what exactly is manifested in the aforementioned paragraph 20.7:

[…]20.7 The Terms, and your relationship with Google under the Terms, shall be governed by the laws of the State of California without regard to its conflict of laws provisions. You and Google agree to submit to the exclusive jurisdiction of the courts located within the county of Santa Clara, California to resolve any legal matter arising from the Terms. Notwithstanding this, you agree that Google shall still be allowed to apply for injunctive remedies (or an equivalent type of urgent legal relief) in any jurisdiction.

Here, Google explicitly states that the usage of its services and everything related shall fall under US law. There is however, an apparent conflict in cases the involvement of a non-US-located user triggers foreign jurisdiction. Since I am a European citizen, I will elaborate on this point a bit more later on, especially in the context of European data protection laws.

So, this was the Google Terms of Service. Now, I’ll poke the Google Privacy Policy a bit. =D

Google Privacy Policy

Of course Google needs user’s data to be able to provide its services. However, there is the question to which extent Google demands personal data and for which purposes it is exactly used.You can read the complete Google Privacy Policy here: http://www.google.com/intl/en/privacy/privacy-policy.html

First, Google lists the type of information that it may collect and possibly use. This listing is okay, I just would wish for a stronger highlighting of the Google Dashboard function, which gives the user a good overview over stored information. Interesting is the fact that Google uses cookies to track users and collect information about their searches within the search engines. This happens for purposes of advertisement/publishing as well as for improving their own services. I stumble upon this sentence:

Google also uses cookies in its advertising services to help advertisers and publishers serve and manage ads across the web and on Google services.

Here, it is not clearly explained how this “use” takes place, so if Google implements e.g. user information into their own services to optimise them for their advertisement and publishing customers or if the information itself is given directly to them. Also, it not exactly said to which extent data is used and in cases of disclosure, if it is aggregated to remove the personal components. Also of importance may be the following:

Google processes personal information on our servers in the United States of America and in other countries. In some cases, we process personal information outside your own country.

In my opinion, this has some relevance since personal data of non US citizens which is processed on US servers may be assessed by US governmental bodies, such as investigation bodies or Homeland Security, which may have authorisation e.g. via the US Patriot Act. Such disclosures may even happen under gag-order so the affected person may never learn about it. Other legal grounds for the legitimate seizure of personal data by foreign states are thinkable. This on the other hand, may violate the law of the country the user is located in, for instance, the European data protection law, if a user is located somewhere in the European Union or European Economic Area. Note: "processing outside the country" may not only mean servers in another country but imho also applies in cases a server centre is located in your country, but a Google+ admin executes remote access from anywhere else in the world.

Under the point “Information sharing”, Google furthermore declares the sharing of personal data outside the company as follows:

We provide such information to our subsidiaries,affiliated companies or other trusted businesses or persons for the purpose of processing personal information on our behalf. We require that these parties agree to process such information based on our instructions and in compliance with this Privacy Policy and any other appropriate confidentiality and security measures.

This paragraph is extremely vague to me. Okay, this solely applies to sub-processing operations, but still. Who exactly are these subsidiaries, affiliated companies and other trusted businesses or persons? Especially the term “trusted” makes me headachy – what does count as trustworthy to Google? Depending on the interpretation of such things, information potentially could be shared with practically anyone in my opinion.And it is not clear if these sub-processors are contractually bound to the same level of adequate data protection as Google itself is towards its users. At least, “appropriate confidentiality and security measures” sounds vague at best.

And last, but not least, there is to mention that Google adheres to the US-European Safe Harbor Privacy Principles, allowing this US-based company to import personal data from the European Union. Nevertheless, these principles (you can see them here: http://safeharbor.export.gov/companyinfo.aspx?id=10543) are not phrased in a way to be legally binding directly, so the enforcement of European user’s data protection rights may prove quite difficult. Regarding a potential direct applicability, the European data protection law provides many uncertainties.This is due to Article 4 (1) of the EU Data Protection Directive 95/46/EC provisioning that the service provider must have kind of an"establishment" or makes "use of automated or on-automated equipment for processing, except for purposes of mere transit" within the EU. Hence, the statutory seat of the company or data centres for the purpose of processing the data of service customers may trigger the applicability of EU law. Nevertheless, this leaves quite wide open gaps whenever a foreign company neither has its headquarters nor any data centres within the community area but still offers its services to EU citizens. Currently, the European data protection directive is under revision and I am curious to learn how this issue will be addressed.

Google+ Privacy Policy

Google+ has its own Privacy Policy,tailored to the specific Google+ services, which complements the general Privacy Policy of Google. You can find it under this URL: https://www.google.com/intl/en/+/policy/.

So let’s see if we find even more fascinating things, shall we?

Under the key word "Location", related to the use of Google+ with mobile devices, there is just an opt-out presetting regarding location information whenever the user wants to share posts:

When you post content to Google+ from your mobile device, you may opt out of the collection and display of your location on a per-post basis or choose to exclude your location from all of your posts. When posting from a non-mobile device, you can choose to add your location on a per-post basis.

As you can extract from this, once you create a post from a non-mobile device, you have the opt-in option to reveal your current location. But once you use your mobile phone or any other device en route, I understand this in the way that you are forced to look into your posting settings every single time you publish stuff.

Regarding the use of the personal information that will be provided via Google+, Google states the following:

We may share aggregate statistics about Google+ activity with the public,our users, and partners, such as publishers, app developers, or connected sites.

Again, I am at a loss how to interpret the text here exactly. "Aggregated statistics" may mean that this aggregation follows standard of IT data processing, focusing on summation and average values (such as how many men/women, Europeans, etc. use which aspects of the service). But it may also mean something entire else.Google does not explicitly position itself to this question. So there is a lot of leeway how this aggregation will be executed. This question may be of some importance since a faulty handling of such aggregation techniques may lead to an accidental exposure of personal data. Need an example? Just think about small groups of persons where any kind of information may reveal the individual's affiliation to certain behaviour. For instance, the information "divorced men over 50 from village xy like to click on porn sites during working hours. Village xy has 1500 residents" may very well make it possible to identify persons. Also, nowadays it is not truly difficult to automatically run search queries over information pieces to connect them to information from other sources, enabling a link to certain individuals. I think that especially within Google, which also offers lots of other web-based services, this must be considered. Furthermore – as you can read from the text - Google reserves itself the right to share this aggregated data with practically everyone. Btw: in this context, I would interpret the term "publisher" as any website operator who uses Google Analytics or Google's webmaster tools. But it may also be that they fall under the definition "connected sites".

For photo tagging, there is also just an opt-out solution:

After someone tags you in a shared photo or video, you may choose to remove the tag.

Translated: If it is any kind of embarrassing photo, the damage is already done before you have a chance to avoid it.

Going on, we now come to third-party-apps:

You may choose to access Google+ through third-party applications (e.g.non- Google websites) by authorizing these applications to access all or part of your Google Account via the Access Request page. The developer of the application may have access to your email address and to the content you have access to in Google+ (such as content friends have shared with you). The developer may also request additional information from you, such as your location for mobile features of Google+. You can revoke the developer's access to your Google Account at any time by visiting this settings page (link).

And corresponding, you can read a bit further below:

If your friends use apps, those applications may gain access to content and information about you that those friends can access.

Well, I personally think that Google has included some mishap phrasing here. I strongly guess that that they wanted to point out that some these third-party apps need the information to provide the access to Google+. It also may play a role that Google wants to indicate that they may not have influence on what third-party-apps exactly do with your mobile devices. However, this highlights the potential danger of granting access rights by your own friends towards the apps they are using. So one must be aware that friends may willingly or just carelessly (by not reading the ToS of their apps they are using) possibly reveal your personal data.

Google+ Button Privacy Policy

Last, but not least, there is the Google+Button Privacy Policy, which can be accessed here: https://www.google.com/intl/en/+/policy/+1button.html

In order to use the Google +1 button, you need to have a public Google Profile visible to the world, which at a minimum includes the name you chose for the profile. That name will be used across Google services and in some cases it may replace another name you’ve used when sharing content under your Google Account. We may display your Google Profile identity to people who have your email address or other identifying information.

This is a service that is clearly caused by Google's aspiration to suggest potential contacts to its users that may be of interest to them. Nevertheless, it is troubling me that Google connects information of its e-mail services with the Google+ service. Of course, Google has ToS for each of its services, but this does not implicate an all-embracing consent of data usage for all.At least Google provides an opt-out for this functionality.

We may share aggregate statistics related to users’ +1 activity with the public,our users, and partners, such as publishers, advertisers, or connected sites. For example, we may tell a publisher that “10% of the people who +1’d this page are in Tacoma, Washington.”

Again, this aggregated statistics clause, slightly busted up with a tangible example.However, despite the example, it still does not exactly define the aggregation methods and may entail the possibility of connecting certain information to individual users. And Google reserves the sharing rights with practically everyone for the personal data disclosed within the Google+ service as well.

We will store data (such as your recent +1’s) locally in your browser. You may be able to access and clear this information in your browser settings.

I am not entirely sure how to understand this. So: Google stores data locally on my own device. Which kind of data may this be in detail and how will they do it? I guess the mention of the browser and its settings is a hint toward cookies but there may be other possibilities (I am such a tech dummy…). For how long will this data be stored if I do nothing with my mentioned browser settings? And for which purpose will this data be stored? Questions over questions…

That's it,I'm almost done. Before I conclude, I just give some brief thoughts on Google's real name policy. Much has been said abut it already all over at this place, so I won't bore you with just repetitive remarks on that. Just this: Which rights do people have who create accounts with pseudonyms? And what will happen once such a person decides to exercise these rights in practice? For instance, an account gets deleted for some reasons – will this person be forced to reveal his/her real name to get hold of data stored within this account? In my view, Google needs not just to rid of this stupid real name policy. It also must think such potential issues through to avoid being put up with the reproach of factually depriving its user's of their lawful rights by forcing them into the open.

Finally, I am drawing the conclusion that Google still needs to work much more on its data protection settings and policies. Notwithstanding, despite all the faults I've found, Google's handling of personal data is considerably better than it is done by its competitor Facebook nowadays. If nothing else, the circles and the overall design of the site with its easy usability are surely a major coup that draws a lot of people in. Hopefully, with the current lively debates going on relating to privacy and data protection issues of social networking sites, Google will develop some more sensitivity regarding the protection of personal data. Until then, we, the users, should not stop urging big social network providers to value our wishes for privacy and security more than they currently do.