 |
Google Street View's Troubles in the United Kingdom: Why the UK May Pose a Legitimate Privacy Challenge for Photographic Mapping, and How Google Should Respond |
By ANITA RAMASASTRY |
|
| Wednesday, April 8, 2009 |
In late March of this year, Google Street View started offering its service -- which allows users of Google Maps to explore neighborhoods at street level "virtually and to take virtual walks through cities around the world" -- in the United Kingdom. Google captures these photographic images by sending vehicles with cameras mounted on their roofs to drive through nearly every street in a given city.
In response, citizens and UK newspapers questioned Google's surveillance tool and worried about Google's influence on people's privacy.
As of early this year, Google Street View already was capturing images in the United States, the Netherlands, France, Italy, Spain, Australia, New Zealand and Japan. However, the UK's reaction to Street View has been especially negative.
In this column, I'll explain the controversy and argue that Google can likely overcome privacy concerns if it further tailors its Street View protocols to more closely mirror how the closed-circuit TV (CCTV) industry handles its photography of British streetscapes.
Street View Has Triggered A Spate of Privacy Complaints and Even a Mob in the UK
Google Street View captures its images by sending automobiles with special cameras mounted on their roofs to drive every street in a city. Recently, a mob of angry British villagers in Buckinghamshire confronted and surrounded one such car. According to the Times of London, the villagers were anxious because of burglaries in their area, and wary of any suspicious vehicles. Spotting the Street View car, they formed a human chain and berated the driver. Villager Paul Jacobs told the Times, "My immediate reaction was anger; how dare anyone take a photograph of my home without my consent? I ran outside to flag the car down and told the driver he was not only invading our privacy but also facilitating crime."
Meanwhile, the UK Information Commissioner (ICO) -- – the government entity responsible for enforcing the UK's Data Protection Directive -- received other privacy complaints from citizens about Street View. In addition, the UK privacy nonprofit, Privacy International (PI) has received more than two hundred citizen complaints, prompting it to file an official complaint with the ICO.
Google Had Received Prior Approval from the UK Information Commissioner, But Privacy Concerns Remained
Unlike the United States, the UK, as a member of the European Union, has comprehensive privacy legislation that regulates the private sector (as well as the government) with respect to uses of consumer data or information. Google fell under the ICO's jurisdiction because its cameras would be capturing personal data.
Thus, in July 2008, prior to beginning operations in the UK, Google had sought and received the following approval from the ICO: "We are satisfied that Google is putting in place adequate safeguards to avoid any risk to the privacy or safety of individuals, including the blurring of vehicle registration marks and the faces of anyone included in Street View images. Although it is possible that in certain limited circumstances an image may allow identification of an individual, it is clear that Google are keen to capture images of streets and not individuals."
To protect privacy, Google had promised to blur out the numbers of license plates and also of people's faces if they were clearly identifiable, and to further blur images if anyone contacted Google to complain. The exact nature of Google's promises has been contested in the media, but apparently Google did not promise to blur every face captured on camera. Yet some have argued that by the time a person contacts Google to ask for further blurring, the privacy damage may already have been done.
Thus, privacy fears remain – based on concerns that Street View might cause embarrassment (for instance, to people visiting doctor's offices, or going into sex shops or bars) or even danger (for instance, to a domestic violence victim who wants her location to remain secret). One complaint received by Privacy International came from a woman who had moved to escape a violent partner, but now feared her image was recognizable on Street View. Another came from two male colleagues pictured in an apparently compromising position (they seemed to be kissing, but were not) who suffered embarrassment when the image was circulated at their workplace, and when their female partners learned of it.
Privacy International's Complaint, the Relevant Law, and Google's Earlier Comments
On March 23, 2009, PI filed a complaint with the ICO, which stated: "We are aware that you have given a green light to the product on the basis of assurances provided by the company. However we believe that these promised safeguards in Street View's technology (i.e. the automatic blurring of faces) have not performed to the extent that Google had indicated. Moreover, given the clear embarrassment and damage that some of these images have caused it is in our view entirely unacceptable to address data protection concerns by way of notice and take-down of images. Accordingly, it is our view that Street View violates the Data Protection Act and we ask that you take immediate action to prevent further encroachments on the core principles of the Act."
The UK Data Protection Act (DPA) requires, typically, that companies provide consumers with notice of the type of data they are going to collect as part of their business, and obtain the issuer's consent prior to collecting that data. The problem for Street View was that, while getting prior consent from the affected person is easy in a store or on the Internet, it's extremely difficult when one is filming the entire country.
In May 2008, Google had responded to earlier inquiries from PI about this issue, as follows: "As with all such systems operating at this scale our blurring technology is not perfect -- we occasionally miss a face or license plate, for example if they are partially covered, or at a difficult angle. However, we tested the technology thoroughly before launch and [Google is] confident that it finds and blurs the vast majority of identifiable faces and license plates. For the few that we miss, the tools within the product make it easy for users to report a face or license plate for extra blurring. As always, users can still ask for their image to be removed from the product entirely. We'll also keep working hard to make sure that the technology continues to get even better."
Yet as of now, Privacy International remains unconvinced. In its complaint, it commented that "[a] number of UK media organizations have published a substantial number of examples of images in which the face blurring has failed to work, even when people are directly facing Google's cameras. In some cases one face in three is unaffected by the face blurring technology. Additionally, we are unsure of the effectiveness of the blurring even when it 'works'. We continue to receive complaints from the public that they remain recognizable because of other individual characteristics such as location and clothing."
PI lists a series of examples of the types of complaints it has received. In addition to the two complaints described above, they included the following:
- A man (whose face was partially blurred) was recognized by his partner having a cigarette outside his place of work, when he had not disclosed to his partner that he enjoyed the occasional cigarette.
- A fifteen year-old boy was caught carrying a skateboard, which his parents had expressly forbade him from using.
- A married man was captured speaking at close proximity with a female colleague. Because of noisy road work, he was forced to speak into her ear, but the image created the appearance of intimacy, leading to an argument with his wife.
- A man complained that on Street View, the only non-blurred number plate on his street was that of his own car, parked directly outside his home, causing him concern about his security.
- An image showed a woman leaning out of her home's window in the company of a man. Her husband suspected an affair; in fact, the man was a contractor, and the woman was discussing a quote for exterior painting work.
What Should Google's Response Be?
Although Google has already received the ICO's approval, it would be well-advised to further refine or clarify its privacy safeguards to address Privacy International's and the UK public's concerns.
PI believes that under the UK DPA, filming without procuring prior consent from all the people whose images are captured is "per se unlawful." Yet it notes that closed-circuit TV (CCTV) is permissible because it provides the government with assistance in crime prevention and national security. Google may be able to respond to its critics by making Street View more like CCTV -- which is subject to a code of practice, established by the ICO as guidance to the industry on how it can comply with the UK DPA. Given that street view involves photographs or filming of streetscapes – much like CCTV – the Code of Practice seems a sensible guide for Google to follow.
PI notes that Street View does not meet the best practices set forth in the Code, and details these requirements, including the requirement that cameras "should be sited and image capture restricted to ensure that they do not view areas that are not of interest and are not intended to be the subject of surveillance, such as individuals' private property."
The Code also advises: "You must let people know that they are in an area where CCTV surveillance is being carried out." As PI notes, "The most effective way of doing this is by using prominently placed signs at the entrance to the CCTV zone and reinforcing this with further signs inside the area. This message can also be backed up with an audio announcement, where public announcements are already used, such as in a station. "
Finally, PI mentions protections that are individual-specific: "Staff operating the CCTV system also needs to be aware of two further rights that individuals have under the DPA. They need to recognize a request from an individual to prevent processing likely to cause substantial and unwarranted damage or distress (s10 DPA) and one to prevent automated decision-taking in relation to the individual (s12 DPA)."
PI also emphasized, "Amongst the most harrowing complaints received by Privacy International have been those from women who are living in fear of violent former partners and stalkers." Google may need to come up with some sort of domestic violence protections by which it ensures that it obscures the faces of those individuals to the extent that their neighborhood is captured on film.
Adhering to these safeguards more fully might make it more likely that Street View will be accepted by the British public.
Why did Google Street View Succeed in the United States?
When Google Street View was rolled out in the United States in 2007, it sparked similar reaction to those we are now hearing from the UK. Today, it covers much of the country, including small towns and major cities. While some initial privacy concerns were raised, Americans have by and large now accepted Street View. However, it's possible that the UK experience will be different, and complaints about Street View will continue and even intensify. Culturally, those in the UK seem to value privacy more than Americans do. Moreover, the US lacks a true counterpart to the UK Data Protection Act, which places affirmative obligations on private companies with respect to consumer privacy.
There have been a few legal actions against Street View. One protest – which I described in a prior column – involved an entire city that attempted to get itself removed from Street Maps, because all streets were owned by the residents under private contract. In another lawsuit, the Borings, a couple living in Pittsburgh, Pennsylvania, sued Google after images of their driveway and their house appeared on Street View. The Borings sought damages and alleged that Google had virtually trespassed on their property through the posting of photos of their house. A judge dismissed their case in February 2009, because they had never exercised their right to ask the company to remove the photos in question. In the United States, the simple act of removing images is considered a sufficient safeguard of privacy; in the UK, according to PI, private companies must obtain citizen consent PRIOR to collecting images.
In the end, Street View may become old news in the United Kingdom, with its citizens adjusting to the service just as those in other countries have. However, Google should pay close attention to the differences between UK and US law, and also to different cultural views of privacy – and consider revisiting its privacy policy. And perhaps most importantly of all, it should work to get its blurring technology as perfect as possible – before its cars and cameras are destroyed by angry villagers.