Nomination for the Australian Privacy Foundation ‘Big Brother Awards’ 2011
BBA2011 FINALIST

Criteria for a BBA2011 Award
The purpose of these Awards is to publicise privacy-abusive behaviour.  A responsible approach is adopted.  As appropriate for the particular Award Category the nominee should be a public or private sector individual or organization, a government program or initiative, or a private sector business activity:
•	in or associated with Australia
•	responsible for a truly outstanding abuse (or defence) of privacy.
For a nominee to be considered, they need to be identified, their acts or behaviours that warrant an Award need to be briefly described, and some evidence needs to be provided, preferably both some originating with the nominee itself, and some from other sources such as the media. The deed for which they are nominated should have at least partially been put into practice – they lose points for just planning or announcing something!  Further details about BBA2010-11 are available at http://www.privacy.org.au/bba/.

A.   Name of Nominee

Eric Schmidt (immediate past) CEO of Google 

B.   Award Category - Privacy Abuser Categories for an “Orwell” Award 

Boot in the Mouth – for the ‘best’ (most appalling!) quote on a privacy-related topic.

C.   Description
Award is to a CEO of a very powerful and experienced information technology company for blatantly blaming a ‘single engineer’  for the collection of Wi-Fi meta-data and personal information in Australia undertaken by Google Street View vehicles, as they drove past millions of homes and businesses and failure to acknowledge the importance of privacy. 

“In May, Google admitted that cars it sent roaming around the world to take pictures of homes for its Street View application were also rigged with software that collected data about the location of residential WiFi networks, which let users connect devices wirelessly to the Internet over short-range airwaves. The firm wanted to compile WiFi network location data so it could use it for future mobile phone applications built around users' geographic location.” Source: http://www.washingtonpost.com/wp-dyn/content/article/2010/11/10/AR2010111007003.html

“In an interview with the Financial Times, CEO Eric Schmidt said the whole affair came about because a software engineer inserted unauthorised code into the Street View system software. The man is now under investigation internally by the company, he said.” Source http://www.tgdaily.com/business-and-law-features/50076-single-engineer-caused-street-view-scandal-says-schmidt. Privacy International concluded that “This collection of by Google cannot be blamed on the alleged ‘single engineer’ who wrote the code. It goes to the heart of a systematic failure of management and of duty of care.”  No company of the size and influence of Google should have permitted this, or similar breaches and errors to occur. The collection demonstrates an ongoing disregard for privacy. It shows that, at the very least, that Google’s internal controls and monitoring systems require extensive revision. Google boss Eric Schmidt is quoted as stating there was "no harm, no foul" in collecting the snippets of information. “Who was harmed? Name the person," Mr Schmidt said during an interview at the company's annual Zeitgeist conference held in Watford in mid-May. Source: http://www.bbc.co.uk/news/10375623

Google cannot claim it did not know the collection of this data was illegal in Australia. Companies are obligated to obey the laws and regulations of countries in which they operate. In addition, the communications laws of nearly all countries permits the interception and recording of content of communications only if a police or judicial warrant is issued. All other interception is deemed unlawful. 

D.   Evidence of the Actions and References
http://www.itwire.com/it-policy-news/regulation/42920-google-must-return-wifi-data-privacy-lobby
http://www.bbc.co.uk/news/10375623
http://www.tgdaily.com/business-and-law-features/50076-single-engineer-caused-street-view-scandal-says-schmidt
http://www.washingtonpost.com/wp-dyn/content/article/2010/11/10/AR2010111007003.html
http://www.itwire.com/it-policy-news/regulation/42898-govt-travesty-in-google-privacy-case
Source Code Analysis of gstumbler  Prepared for Google and Perkins Coie by STROZ FRIEDBERG June 3, 2010 PDF document entitled “GoodleWifi-ACMA-PC-100528 downloaded 2 November 2010

E.  Why the Nominee Deserves the Award
Scope
It is not possible to ascertain exactly how many people have been affected by this data collection by Streetview vehicles. However, there is no doubt that a large number of Australians, and people in many other countries, have been affected. 

Seriousness
This is perhaps the most serious privacy violation Australia has witnessed and Google’s excuse that it was a “mistake” is irresponsible and not a justification for illegal data collection. The power of technology used by Google and the amount of data it collects and retains makes it essential its CEO ensures the company implements and enforces strategies that strongly protect privacy. No one single engineer should have the authority to implement applications capable of causing such serious errors. This event indicates very poor management of internal processes.

Australian consumers have privacy rights under both the Privacy Act 1988 and Telecommunications (Interception and Access) Act 1979.

Privacy Act 1988
Google Australia is required to comply with the National Privacy Principles. The Australian Privacy Foundation is considering a complaint that Google has breached NPP 1 Collection, NPP 9 Trans Border Data Flows and/or NPP 10 Sensitive Information. Section 36 and Section 38 of the Privacy Act allow for individual and representative complaints.

Telecommunications (Interception and Access) Act 1979
Section 7 of the Act prohibits unauthorised interception of a communication passing over a telecommunications system. Several exceptions apply, none of which are relevant to Google. The Act includes both criminal and civil penalty regimes. The relevant provisions only require that an interception of a communication has occurred. They do not require any additional disclosure of the communication. Sub-sections 7-10 provide a series of remedies, including a declaration of unlawful conduct, injunctions and damages.

F. Other Comments (including Nominee Response)

This nomination form was emailed to the nominee on 18 March for comment by 8 April 2011. No response was received by the Coordinator of BBA2011 by 9 April 2011.