Commentary

Privacy Groups Seek To Scuttle Google's $8.5 Million Data-Leakage Settlement

Google's attempt to settle a privacy lawsuit by donating $8.5 million to nonprofit groups and schools should be rejected, advocacy groups argue in a letter to U.S. District Court Judge Edward Davila.

The groups argue that the proposed settlement should be nixed for several reasons, but the most significant is that the deal allows Google to continue engaging in the same activity that led to the lawsuit -- leaking the names of people who use its search engine. The only difference for Google is that the deal requires it to revise a section of its privacy policy.

Under the logic of this proposed settlement agreement, "a company that manufactures a faulty toaster that catches fire because of poor wiring is permitted post-settlement to continue to manufacture the toaster as before with no change to the wiring that created the risk to the customers, as long it notifies customers of the risk arising from its ongoing negligence,” the organizations write. Signatories include the Electronic Privacy Information Center, Consumer Watchdog, Center for Digital Democracy, Patient Privacy Rights and Privacy Rights Clearinghouse.

If accepted by Davila, the deal will resolve a 2010 class-action lawsuit accusing Google of violating its privacy policy by including search queries in "referrer headers" -- the information that is automatically transmitted to sites that users click on when they leave Google. Some queries, like people's vanity searches on their own names, can provide clues to their identities.

The user who sued -- Paloma Gaos -- alleged that she conducted searches for her own name, as well as her family members' names, and clicked on links on the Google search results. Therefore, she argued, Google disclosed her "sensitive personal information" to third parties by transmitting her queries in the referrer headers. One year after Gaos filed suit, Google revised its policy on the information it includes in URLs. Now, when signed-in users visit a site after clicking on a link in the organic results, Google doesn't send the search queries to the destination site. But the company still transmits the entire search query when users visit a site after clicking on an ad.

The tentative deal requires Google to make donations to the World Privacy Foundation, Carnegie-Mellon, Chicago-Kent College of Law Center for Internet, Society & Policy, Berkman Center for Internet and Society at Harvard University, Stanford Center for Internet and Society; and the AARP. The proposed agreement doesn't call for Google to pay anything to consumers; the San Francisco lawyers who brought the case, Michael Aschenbrener and Kass Nassiri, intend to seek up to $2.125 million in attorneys' fees, according to court papers filed this week by Aschenbrener.

Opponents to the deal also take issue with the donation recipients, as well as the fact that Google users won't receive any money.

The critics say that one of the laws Google is accused of violating -- the Stored Communications Act -- calls for damages of at least $1,000 per violation. “Given the potential statutory damages at stake, the omission of any monetary relief to class members is a glaring deficiency,” they argue.

The advocacy organizations also point out that only one of the seven proposed award recipients -- The World Privacy Forum -- exists primarily to protect privacy.

Davila is expected to hold a hearing tomorrow, when he will hear arguments about whether to grant deal preliminary approval.

Next story loading loading..