EUROPE'S TOP COURT SUPPORTS 'RIGHT TO BE FORGOTTEN' IN GOOGLE PRIVACY CASE

Original Story: Edition.CNN.com

(CNN) -- People have the "right to be forgotten" and search engines like Google must remove certain unwanted links, Europe's top court decided in a surprise ruling Tuesday.

The case, which spotlighted the clash between privacy and freedom of information advocates, centered on a Spanish man's efforts to remove historic links to his debt problems.

In its decision, the European Court of Justice found operators of search engines such as Google were the "controller" of information. They were therefore responsible for removing unwanted links if requested.

"An Internet search engine operator is responsible for the processing that it carries out of personal data which appear on web pages published by third parties," the judges said in a statement about the ruling.

A Google spokesman, in an email to CNN, said the ruling was "disappointing," and that the company needed time to "analyze the implications." Google had previously argued it was only hosting the data and said it was up to the individual websites to remove the data.

The decision came as a surprise to the industry and legal experts, as it ran contrary to the court's Advocate General opinion, whose guidance is usually followed.
Does Google know too much about us?
Your G-mail is watching you
Getting caught on Google maps

"For Google, this result creates a headache -- and potentially huge costs," University of East Anglia Law School lecturer Paul Bernal said. "The ruling looks like a strong decision in favor of privacy and individual rights -- and against the business models of search engines, and certain aspects of freedom of speech."

The case arose in 2010, when Mario Costeja Gonzalez complained to the Spanish Data Protection Agency about an old newspaper notice detailing his social security debts.

The advertisement was placed in a Spanish newspaper by the Ministry of Labour in 1998. It detailed a property auction being held to recover the debts.

Gonzalez argued that he had long resolved his debts and the information was no longer relevant. He complained that details about his old debts were coming up in Google search results, which he said violated his data protection rights.

The Spanish privacy watchdog rejected the complaint against the newspaper, saying it was right to publish the information at the time of the auction.

However, it also said that Google had no right to spread the news about Gonzalez further and ruled that the search engine must remove the link from the list of results. Google challenged the ruling with the Spanish High Court which referred the case up to EU's top court.

International watchdog Index on Censorship said the ruling "violates the fundamental principles of freedom of expression."

"It allows individuals to complain to search engines about information they do not like with no legal oversight. This is akin to marching into a library and forcing it to pulp books." Index said in a statement.

Child Web Privacy Law Gets Updated

originally appeared in The Wall Street Journal:

In a move to update rules governing children's privacy online to cover new areas like smartphones, U.S. regulators broadened decade-old policies, but amid pressure from the technology industry backed away from proposals that could have made companies like Facebook Inc. and Apple Inc. more responsible for violations.

The Federal Trade Commission said it would change how it implements the Children's Online Privacy Protection Act of 1998, or Coppa, to reflect the growth of social networks and smartphone apps among children.

The commission also expanded the types of information it considers personal under the law. Kids' apps and websites will now have to obtain parental consent before gathering photos, videos or geographic location, and before tracking kids' online behavior and passing along the data to other companies.

But in a departure from rule changes the government proposed in August, the FTC explicitly exempted app stores like those run by Apple and Google Inc. from responsibility for privacy violations by the games and other software that are sold there.

The updated rules, which go into effect July 1, also make clear that software such as Facebook's "Like" button and ads placed by advertising networks will only have to meet child online privacy regulations if companies have "actual knowledge" that they're collecting information through a website or app that targets kids.

The commission's move ended one chapter in the long-running Washington debate over how closely the government should regulate online privacy, but set the stage for new battles.

Consumer advocates said they would continue their push to make Apple and Google more responsible for the data-gathering practices of the apps they distribute, while several members of Congress are pushing legislation to further tighten limits on online tracking of children and teenagers.

Just last week, the FTC put a spotlight on gaps in kids' online privacy with a report that found hundreds of popular kids' apps were collecting data without parental consent.

Coppa governs how companies must proceed when collecting personal data from children under the age of 13. Enforcement falls to the FTC, which has been reviewing how it should approach the law in the age of smartphones and social media for two years. Kids' entertainment and Internet companies have lobbied heavily to blunt the impact of the update.

Apple, for example, met with FTC officials five times this fall, in particular contesting the possibility that the updated rules might hold it responsible for the data-collection practices of the third-party apps it distributes on the iPhone and iPad. Google made a similar point in a filing with the commission.

Google said it was evaluating the changes and would continue to work on effective ways to protect children's privacy and security. Facebook said it was pleased with the FTC's decision on so-called plug-ins, such as the "Like" button.

In several cases, the industry got what it wanted. Reversing a prior proposal, the commission agreed to continue to allow parental consent to be obtained by email as long as apps and websites only collect data for internal use.

The FTC's Chairman said the final rules strike the right balance between protecting innovation that will provide rich and engaging content for children, and ensuring that parents are informed and involved in their children's online activities.

While Apple, Google and Facebook scored partial victories, some smaller developers were disappointed. The president of the Application Developers Alliance, said that the new regulations could prove so burdensome that talented and responsible developers will abandon the children's app marketplace.

One FTC commissioner voted against the updated rules. She argued the commission went too far with the update by holding websites responsible when third parties like advertising networks gather personal data from children.

But some government officials made clear Wednesday they would like to place additional regulations on technology companies. Sen. John D. Rockefeller IV (D., W.Va.), a leading advocate on privacy issues, said he viewed the Coppa regulations as a step toward legislation that gives Americans more control of how they are tracked online.

The executive director of the Center for Digital Democracy and a consumer advocate who has been involved in the Coppa debate for years, said the FTC's decision was a step in the right direction but left loopholes for companies to mine kids' data inappropriately.

He said he would continue to push for more scrutiny of the role of the Internet giants that distribute kids' apps.

The FTC's chairman has made monitoring online privacy one of his priorities at the commission. At Wednesday's news conference announcing the revised rules, he repeatedly held up what he said was his 15-year-old daughter's white iPhone to illustrate how much technology has changed in the past decade.

It was enormously difficult for me to pry this away from my child today, he said.

Google Worries About New Data-Handling Privacy Laws

First appeared in USA Today

They may be battling each other tooth-and-nail to win over online advertisers. But Google and Facebook are on the same side when it comes to opposing new data-handling privacy laws fast-gelling in Europe and the U.S.

On Wednesday, the European Union formally proposed strict rules that could restrict much of the systematic tracking and profiling Google and Facebook routinely do of Internet users, as part of delivering targeted ads to them.

If Europe's new rules are implemented as expected in 2013, the tech rivals could face hefty fines, up to 2% of annual revenue, for any violations. In Google's case that translates into a maximum penalty of $800 million.

On Tuesday, Facebook Chief Operating Officer Sheryl Sandberg delivered a statistics-filled speech at a tech conference in Munich outlining how Europe's proposed rules are very likely to stymie the global economy.

Sandberg called for a "regulatory environment that promotes innovation and economic growth."

Google spokesman Chris Gaither echoed Sandberg's argument. He says the search giant "supports simplifying privacy rules in Europe to both protect consumers online and stimulate economic growth."

Meanwhile, refinements announced this week by Google and Facebook, about how each tracks and profiles Internet users, added heat to the domestic debate over the need for new data privacy rules here in the U.S.

Google signaled that it will begin cross-referencing user data compiled from its most popular services, including search, Google Apps, Gmail and YouTube. The stickler: Users won't be permitted to "opt out" of having their Google activities correlated.

"Google is taking that option away," says P.J. McNealy, analyst at Digital World Research. Younger Internet users may not care much, he says. But Google patrons who are "more cautious or conservative with their personal data" may "cringe," McNealy says.

Meanwhile, the non-profit group SafeGov, which monitors security issues for federal, state and local government agencies, is alarmed that Google's new policy could put workers who use Google Applications for Government, a paid service, at heightened risk.

"Google should not be data-mining information in e-mails, text messages, searches and documents that workers are putting into Google services," says Jeff Gould, SafeGov security analyst. "It's a matter of not making government workers unnecessarily exposed to hackers and to inadvertent disclosures of information."

Google Vice President Amit Singh says Google's new privacy policy for consumer data is superceded by data privacy provisions in contracts with government agencies and other organization who use the paid version of Google Apps.

"As always, Google will maintain our enterprise customers' data in compliance with the confidentiality and security obligations provided to their domain," says Singh.

But Gould checked the city of Los Angeles' contract with Google and found that the data-privacy provision referred back to Google's policy for consumers. "They didn't think through the consequences for government users," Gould says.

Meanwhile, Google is busy fielding inquiries from a handful of politicians who've proposed legislation that would restrict online tracking and establish rules for data privacy.

"Amazingly, we still don't have a law that sets the rules of the road for fair information practices that everyone collecting, using, and distributing people's personal information must adhere to," says John Kerry, D- Mass.

Kerry and Sen John McCain, R-Ariz., continue to work for passage of the Commercial Privacy Bill of Rights. "Until Congress acts, Google and the rest of its competitors will continue to set that standard themselves. "

Rep. Ed Markey, D-Mass., notes that "Googling is like breathing for millions of kids and teens - they can't live without it." Markey, who has also been critical of Facebook's tracking practices, is calling on the Federal Trade Commison to review Google's new no-opt-out policy.

"Consumers - not corporations - should have control over their own personal information, especially for children and teens," says Markey.

Facebook is drawing more scrutiny too. It is making mandatory a new, glitzier user interface, called Timeline, that chronologically displays a member's preferences, contacts and online activities.

Facebook says Timeline does not present any new information nor alter any privacy settings.

Even so, SafeGov analyst Gould, for one, is concerned. "If you take the new Google policy and combine it with Facebook Timeline, the danger of hacking attacks for government users is multiplied by ten," he says.

More intensive tracking and profiling by the tech rivals puts richer data in cyberscammers' hands.

Gould worries about the all-too-common scenario where an intruder e-mails a government worker pretending to be an acquaintance. "They can put information in an e-mail which they can get from your Facebook Timeline, and trick you into downloading a piece of spyware," he says.

Heightened cross-referencing of an individual worker's Google Search Company, Gmail and YouTube activities poses similar risks, he says.