I was up in Sacramento today to call on the Department of Motor Vehicles to ensure that the regulations that they are developing to govern the use of autonomous vehicles – popularly known as driverless cars -will protect the operators’ privacy.

The company that will be most directly affected by the new autonomous vehicle regulations is Google, which is pioneering development of the robot-driven cars. The Internet giant was the driving force behind SB 1298, which charged the DMV with the task of developing the regulations and also rebuffed attempts to require privacy protections in the law.

However, it is not too late to implement privacy safeguards in this rulemaking and Consumer Watchdog called on the DMV to do so. Failure to act will mean substantial privacy risks from the manufacturers’ driverless car technology if there are not protections from what Google is best known for: the collection and use of voluminous personal information about us and our movements.

The DMV regulations must give the user control over what data is gathered and how the information will be used.  Merely stating what data is gathered with no explanation of its use is woefully inadequate. The DMV’s autonomous vehicle regulations must provide that driverless cars gather only the data necessary to operate the vehicle and retain that data only as long as necessary for the vehicle’s operation.  The regulations should provide that the data must not be used for any additional purpose such as marketing or advertising without the consumer’s explicit opt-in consent.

Without appropriate regulations, autonomous vehicles will be able to gather unprecedented amounts of information about the use of those vehicles.  How will it be used?  Just as we are now tracked around the Internet, will Google and other purveyors of driverless car technology now be looking over our shoulders on every highway and byway? Will the data be provided to insurance companies for underwriting purposes or to third parties that develop some kind of a driving score related to where and when individuals travel?  Will it be used to serve in-car advertisements or advertisements through other venues in the Google suite of products? Will it be used to track our movements and those of surrounding cars and mobile devices so that Google’s advertisers can better locate us?

Google is the aforementioned leader in driverless car research and is attempting to steer regulatory efforts in various states, especially California.  That’s why our concerns are so focused on the company. So I ask:  Why won’t Google endorse simple privacy safeguards for its self-driving cars?  I think there are two reasons.

First, Google’s entire business model is based on building digital dossiers about our personal behavior and using them to sell the most personal advertising to us.  You’re not Google’s customer; you are its product – the one it sells to corporations willing to pay any price to reach you.  Will the driverless technology be just about getting us from point to point or more about tracking how we got there and what we did along the way?

Second, computer engineers, who believe that more data is always better, are in charge at Google.  They may not know what they would use data for today, but they think they may someday find a use for it and don’t want any restrictions on them now.

Google is first and foremost an advertising company; 98 percent of its $38 billion in revenue comes from advertising, and the more personalized the marketing the better.  Indeed, Executive Chairman Eric Schmidt has said, “We don’t need you to type at all. We know where you are. We know where you’ve been. We can more or less know what you’re thinking about.”

We all remember the last time Google deployed high tech vehicles around the world.  The result was Wi-Spy, the biggest wire-tapping scandal in history when the company’s Street View cars sucked up data from tens of millions of private Wi-Fi networks, including emails, health information, banking information, passwords and other data.  The company paid $7 million to settle the case brought by the state Attorneys General.  A class action suit is pending in federal district court.

Citing its “Don’t Be Evil” motto, Google claims it can be trusted with our information.  Facts show otherwise. The FCC released documents showing the Wi-Spy scandal was not a mistake or the work of one rogue engineer, as the company had claimed; but was part of the Street View design. The Commission fined Google $25,000 for obstructing its investigation.

The Federal Trade Commission imposed a $22.5 million penalty on Google for violating a consent agreement and hacking around privacy settings on Apple’s Safari browser, which is used on iPads and iPhones. Simply put, there is no reason to believe Google when it claims to be concerned about privacy.

Consumers enthusiastically adopted the new technology of the Internet.  What we were not told was that our use of the Information Superhighway would be monitored and tracked in order to personalize corporate marketing and make a fortune for companies like Google.  Consumer Watchdog supports driverless car technology and predicts it will be commonplace sooner than many of us expect.  However, it must not be allowed to become yet another way to track us in our daily lives.

Internet technology was implemented with little regard to protecting users’ privacy.  We are playing catch-up for our failure to consider the societal impact of a new technology.  The time to ensure that this new driverless car technology has the necessary privacy protections is while it is being designed and developed.   This is a concept known as “Privacy by Design.” It means privacy issues are considered from the very beginning and solutions are “baked in.” Trying to catch up after a new technology is developed and broadly implemented simply will not work.  The DMV should act to require that consumers must give opt-in consent before any data gathered through driverless car technology is used for any purpose other than driving the vehicle.

While we don’t propose to limit the ability of the cars to function by communicating as necessary with satellites and other devices, the collection and retention of data for marketing and other purposes should be banned. Unless strong protections are enacted in the new regulations, once again society will be forced to play catch-up in dealing with the impact of the privacy invading aspects of a new technology.

Posted by John M. Simpson, Director of Consumer Watchdog’s Privacy Project.  

Target is targeting our privacy. There’s a big red bullseye, a target – like the one on the shirt I’m wearing today – that Target and Neiman Marcus, who chose not to show up to answer questions today, have put on us because they haven’t done enough to protect our private financial data. And the reason is that there’s no financial incentive to do so.

110 million Americans had their personal financial information breached. That ‘s one out of two adult Americans. I was in Sacramento today to testify in front of a joint California Assembly committee hearing investigating the breach. And yet Target did not send a single representative to Sacramento today to answer questions about the largest data breach in American history?

The fact that Target didn’t show up today tells us all we need to know about how sorry Target is and how committed it is to our privacy.

If you are as offended by this as I am, I have a t-shirt for you to wear too.

The reason Target won’t face legislative questions today is the same reason that our personal financial information and data is at such grave risk: there is no price to pay. There are few financial penalties to companies like Target when our personal data is taken.  

Beyond public embarrassment, Target has little financial incentive to care.

We, the consumers, pay the consequences but we have no remedies.

According to the Committees’ own staff research, 1 in 4 consumers whose personal information that is taken becomes a victim of identity theft. 1 in 4 victims of a data breach is also a victim of identity theft. If these numbers apply to Target, that would potentially create more than 25 million identity theft victims.  

There’s a harm. The retailers had a role in creating that harm. And yet they have no liability under California law for what they have or have not done to safeguard the sanctity of our personal information.

The problem with privacy violations is that unlike thefts of money or property the law does not recognize a harm and does not provide a remedy.

As the Committees’ staff research states: consumers have no remedy under the law for the loss of financial privacy suffered through these data breaches, and the 1 in 4 risk of id theft they face.  Zero remedies.

So why would retailers invest in greater security, or meet voluntary industry standards, or move away from risky magnetic strip technology?  

If they don’t have to pay a price they don’t have an incentive to change.  And that leaves our private financial information with a big bullseye on it.

What can we do?

We need a California financial information act that mirrors our Medical Information Privacy Act.    

When there is a data breach of our medical information, the drug company, hospital or medical center is liable to the consumer for $1,000 per violation.  

Guess what?  Medical data breaches are fewer and farther between. When they occur companies pay a big price.

The same should be true for our financial data. We need a California Financial Information Privacy Act

It would:

• Change notification standards to be immediate.
• Write minimum-security standards into the law so that they are no longer voluntary.
• Set limits on the time data can be retained. And limits on what information can be collected and retained
• Most importantly: create a private right of action. Put a price tag on retailers’ mistreatment of our private financial information.

Until there is a price to pay, Target and other retailers will continue to make us targets.

If you are as offended as I am by Target’s absence today in Sacramento, please share our Target design online to show your displeasure.

When a company as big as Target won’t provide a single representative to answer questions about the largest data breach in American history, it is time for California to step up and deliver on the promise in Article 1 Section 1 of our state constitution: Privacy is an inalienable right.

Posted by Jamie Court, President of Consumer Watchdog.

Google CEO Larry Page simply doesn’t get it when it comes to privacy concerns about the Internet giant’s new computerized eyewear, Google Glass.   He made that crystal clear at the annual shareholders’s meeting Thursday.

I made my annual trek to Mountain View  to attend the Internet giant’s shareholder meeting and pose some questions directly to Google’s top executives.  I said Glass is one of the most privacy invasive and Orwellian devices ever made because it allows a user to surreptitiously photograph or video us or our kids.  “It’s a voyeur’s dream come true,” I said, before noting the hypocrisy in unleashing a device that enables massive violations of everyone else’s privacy, but operating under rules that barred cameras and recording devices from the meeting. Take a look at a video from the meeting.

“Obviously, there are cameras everywhere, ” responded Page.  “”People worry about all sorts of things that actually, when we use the product, it is not found to be that big a concern.”

“You don’t collapse in terror that someone might be using Glass in the bathroom just the same as you don’t collapse in terror when someone comes in with a smartphone that might take a picture. It’s not that big a deal. So,  I would encourage you all not to create fear and concern about technological change until it’s actually out there and people are using it and they understand the issues.”

Page tried to compare the video cameras on ubiquitous smartphones with Google Glass.  That’s exactly the point.  There is a huge difference.  I don’t collapse in fear that I’ll be videoed in the bathroom by a smartphone camera precisely because it’s obvious that someone is using the camera.  I can politely ask them to stop, or escalate my protests as appropriate if necessary. Indeed, consider this satirical video, “Supercharge”, featuring Page and Executive Chairman Eric Schmidt if you don’t understand what I mean. It’s  obvious Schmidt is invading the privacy of the gentleman in the next stall.  Take a look at the video.  You’ll see what I mean.

It doesn’t work that with Glass and that’s what is so creepy. There’s an app that snaps a photo with a wink.  People have no idea that they are being photographed or videoed.  That’s what people are worried about and they want the ability to delete videos and photos from Google’s database when they discover their privacy has been invaded.

Page says we shouldn’t worry about “technological change until it’s actually out there and people are using it.”  He’s wrong.  You need to to think about the impact before the technology is implemented.  That’s what’s entailed in the concept of privacy by design, something that Google just doesn’t seem to get.

And here’s another point to ponder: As Google was holding its annual meeting, The Washington Post was breaking the details of NSA’s overreaching, intrusive snooping on users of some of the biggest Internet companies including Google with its PRISM program.  Can’t you imagine a billion Glass users and a billion winks and the data that would flow to NSA?

____________________________________________________________________

Posted by John Simpson, Consumer Watchdog’s Privacy Project.  Follow Consumer Watchdog online on Facebook and Twitter.

What a week! Three big victories in California will keep us safer from dangerous doctors, toxic polluters and privacy invasions, but we only got there thanks to your support.

State Senator Curren Price and Assemblyman Richard Gordon proposed yesterday to strip the California Medical Board of its authority over physician discipline. The physician-run Board has let dangerous doctors keep practicing as investigations take years to complete. You joined us, and families who lost loved ones to reckless prescribing, when we called for a transfer of doctor investigations to impartial prosecutors at the Department of Justice.

Senator Price said it all when he told the LA Times he proposed cutting the Board’s power because, “I don’t want anybody else to die.” With your help we’ll keep the pressure on in Sacramento to make this reform a reality.

On Wednesday, the state’s top toxics regulator shut down the state’s largest battery recycler, Exide, for leaking lead, arsenic and other toxins into the surrounding community for more than two decades. The action came only after Consumer Watchdog exposed endemic failures at the Department of Toxic Substances Control to prevent pollution and punish serial polluters in our report, Golden Wasteland. Nevertheless, Californians could be on the hook for millions in clean-up costs because the DTSC never required the company to put money away for cleanup.

Rounding out this week’s trifecta was a rare reversal by Google on the privacy front: The internet giant quietly stopped sharing consumers’ private emails and addresses with app developers that use its Google Play store. The reversal came after a Consumer Watchdog complaint to the Federal Trade Commission and California Attorney General Kamala Harris that Google was not only violating consumers’ privacy, but violating its own agreement with the FTC not to share information without consumers’ permission.

And this breaking news: This morning, the Court of Appeal sided with us to reject Mercury Insurance’s attempt to throw out a case the company has delayed for nearly a decade. The suit would hold Mercury accountable for charging illegal broker fees to consumers. We are fighting that battle on a second front before an administrative judge in San Francisco right now.

So that’s really four big wins this week. Thanks for sharing them with us.

________________________________________________________________

Posted by Carmen Balber, Executive Director of Consumer Watchdog.  Follow Consumer Watchdog on Facebook and on Twitter.

Says State Attorneys General $7 Million Deal with Google Won’t Stop Company’s Serial Privacy Abuses

The $7 million deal announced today ending a multi-state investigation of the Google Wi-Spy scandal does virtually nothing to thwart the Internet giant’s repeated privacy violations, Consumer Watchdog said.  The public interest group said Google should pay an amount that would affect its profits.

In addition to the $7 million to be divided among the 38 states and the District of Columbia that were involved in the investigation, the settlement deal provides that Google will create an educational campaign that features a YouTube video to teach consumers about protecting privacy on Wi-Fi networks.

“Asking Google to educate consumers about privacy is like asking the fox to teach the chickens how to ensure the security of their coop,” said John M. Simpson, Consumer Watchdog’s Privacy Project director. “The educational video will also drive consumers to the YouTube platform, where Google will just gather more data about them for its digital dossiers.”

Read the settlement with the state attorneys general here.

Google has become a serial privacy violator, Consumer Watchdog said.  In the Wi-Spy case the company sucked up data including such things emails, passwords, and bank account numbers as its Street View cars photographed streets around the world.  Before that the company exposed personal information of it users when it launched its unsuccessful “Buzz” social network.  That privacy breach prompted a consent agreement with the Federal Trade Commission.  No sooner was the ink dry on the settlement, than Google violated it by hacking around the privacy settings on the Safari browser used on iPads, iPhones and other Apple devices.

“This settlement does nothing too stop Google as a serial privacy violator.  The company now has a long history of violating users’ privacy, lying about it, apologizing, promising not to do it again, sometimes making a token penalty payment and then moving on to the next violation,” said Simpson. “The $7 million penalty is pocket change for Google; it’s clear the Internet giant sees fines like this as just the cost of doing business and not a very big cost at that.”

A pro-consumer candidate to the Federal Trade Commission, who had the backing of the entire public interest community, really wanted the job. But this candidate didn’t want allies to go public for fear of alienating the White House. What happened?  Today POTUS hosed us and gave the keys to the FTC to corporate attorney Edith Ramirez.

The lesson: if you want to speak for the public, you have to speak publicly.

It’s just too easy to get caught up in the quagmire of worrying about alienating powerful people. Back channels and back room are the domain of those who want to turn their back on the public, not advocates for the public.

And the lesson, which came in healthy helpings this morning, can even be lost on those of us who typically have no control of our tongues.

Consider Ron Shinkman’s remarkable report today in Payer and Providers about the pathetic record of California Department of Managed Health Care Director Brent Barnhart.  We didn’t expect much from a former Kaiser lawyer Governor Brown appointed to regulate HMOs, but perhaps a healthy tongue lashing on the front end would have up-ended this record.

As Shinkman records:

Between 2009 and 2011, the Department of Managed Health Care issued nearly 1,000 enforcement actions against health plans, fining them nearly $9 million for a variety of misdeeds and demanding they take corrective actions to protect the interests of their enrollees.

But after Aug. 11, 2011, when Gov. Jerry Brown appointed former health plan lawyer and lobbyist Brent A. Barnhart to head the agency, enforcement actions dropped almost immediately. The DMHC issued only 74 such actions during the remainder of the year, compared to 433 in the portion of 2011 prior to his appointment – although an agency official said that number should be condensed.

In 2012, the DMHC issued 90 enforcement actions, well below its historical average dating back more than a decade. The most significant action of the year was taken not against a health plan, but against the Accountable Care IPA, a medical group that had been using non-physicians to make medical coverage determinations.

Moreover, financial penalties levied against the plans dropped dramatically in 2012. Last year, $451,000 in fines were issued, or just over $5,000 per enforcement action. That’s a stark contrast to 2010, when $2.2 million in fines were issued, an average of more than $20,000 per action. In 2008, fines exceeded $18 million, which included several significant enforcement actions against insurers.

New rule, or old rule remembered: When in doubt, speak out.

____________________________________________________________________

Posted by Jamie Court, author of The Progressive’s Guide to Raising Hell and President of Consumer Watchdog, a nonpartisan, nonprofit organization dedicated to providing an effective voice for taxpayers and consumers in an era when special interests dominate public discourse, government and politics. Visit us on Facebook and Twitter.

Consumer Watchdog Wednesday called on the Federal Trade Commission to ask Congress to pass Do Not Track legislation because “the self-regulatory effort to design Do Not Track is virtually dead in the water.”

In a letter to FTC Chairman Jon Leibowitz John M. Simpson, the nonpartisan nonprofit public interest group’s Privacy Project Director wrote:

“Almost a year ago with great fanfare in the media you said a Do Not Track mechanism would be in place by the end of last year.  You and you colleagues opted to rely on a self-regulatory process to implement Do Not Track, but alluded to the possibility of legislation if that process failed.  Not surprisingly the self-regulatory effort to design Do Not Track is virtually dead in the water.  After a year nothing has changed for the consumer.  You tried to use the bully pulpit, but the advertising industry did not heed your call. The time for words has passed; if you expect Do Not Track to be implemented, the Commission must endorse Do Not Track legislation now.”

Read Consumer Watchdog’s letter here

“As the Commission advocated in its report, Protecting Consumer Privacy in an Era of Rapid Change, a Do Not Track mechanism would offer people control over whether data about them was collected,” Simpson wrote.

Consumer Watchdog noted that the World Wide Web Consortium (W3C), an Internet standards setting organization, has been trying to develop specifications about how the Do Not Track message would be sent and what the obligations would be for a website that receives it.  “Talks have dragged on more than a year with weekly conference calls and six face-to-face meetings, while the W3C’s Tracking Protection Working Group has grown to 102 members,” Simpson wrote. “Another round of meetings is scheduled next month. Talks can at best be charitably described as stalled.”

“You and the Commission repeatedly put faith in self-regulatory efforts and predicted that a Do Not Track mechanism would be in place by the end of the year,” Simpson wrote.  “Unfortunately that optimism has proved to be unwarranted.”

The letter concluded:

“The end of the year as passed. Your words have gone largely unheeded by the advertising industry. The bully pulpit has not brought about a Do Not Track standard. Lest your words be taken as empty threats and given the logjam in the World Wide Web Consortium process, the time for decisive action by the FTC has arrived.  Sen. Jay Rockefeller, (D-WV) introduced a Do Not Track bill in the last session of Congress.  We understand he intends to re-introduce the bill this session.  We call on you and the entire Commission to endorse the urgent need for Do Not Track legislation.  If nothing else, the threat of legislation could be the stick that prompts a recalcitrant advertising industry to stop its foot dragging and re-engage in real negotiations.”

The letter cited numerous times that Leibowitz had predicted the implementation of Do Not Track by the end of last year and raised the possibility of legislation if the effort failed.  For instance, the letter noted:

“‘We are definitely at a critical point in whether folks will be able to come together and develop a real Do Not Track option for consumers,’ you told Politico in October. You said the lack of consensus was ‘encouraging the possibility of legislation — maybe not today, maybe not in the lame duck, but soon.’ You also told The New York Times, ‘It is time to drop some of the bluster and work toward compromise.’

“In November you used the bully pulpit again to tell Politico, ‘If by the end of the year or early next year, we haven’t seen a real Do Not Track option for consumers, I suspect the commission will go back and think about whether we want to endorse legislation.’ ”  

Google may have only received a tap on the wrist from the Federal Trade Commission when the agency closed the U.S. antitrust investigation without taking action against the Internet giant for skewing search results to favor its services, but it’s looking increasingly likely that Google will face strong action on the other side of the Atlantic.

The Financial Times reports that Google will have to change the way it presents search results or face antitrust charges for “diverting traffic.” Competition Commissioner Joaquin Almunia told the newspaper:

“We are still investigating, but my conviction is [Google] are diverting traffic. They are monetizing this kind of business, the strong position they have in the general search market and this is not only a dominant position, I think – I fear – there is an abuse of this dominant position.”

Almunia has told Google that it must make changes to address European concerns or that it will face a formal statement of objections.  Late last year he warned that Google would have to offer remedies this month.

I think you can take Almunia’s strong statements Thursday to The Financial Times as a sign that the European Commission is serious.  While he says he’d prefer a settlement, European law gives the antitrust enforcer a huge stick.  After filing a formal statement of objections, the Commission  can impose a fine amounting to 10 percent of Google’s revenue or about $4 billion. That’s almost as effective to getting executives attention as sending them to the slammer. Unlike the FTC, the European Commission doesn’t have to make its case in Court.  It can simply impose the fine.

As The Financial Times headline read on one story about the situation, “EU Antitrust Chief Holds All the Aces.” Almunia hinted that the antitrust settlement may play out differently in Europe because the law is different.  It’s also true that the Internet giant’s dominance in search is even greater in Europe at 90 percent of the market than the 70 percent share it commands in the United States.

And there is still a strong possibility of meaningful action in the United States.  Texas Attorney General Greg Abbott is actively pursing a case.  His staff has appropriately worked to obtain key Google documents that Google tried to claim were privileged and did not need to be turned over in response to Civil Investigative Demands. From all appearances the FTC staff was nowhere near as diligent in its investigation.

_________________________________________________________________

Posted by John M. Simpson. John is a leading voice on technological privacy and stem cell research issues. His investigations this year of Google’s online privacy practices and book publishing agreements triggered intense media scrutiny and federal interest in the online giant’s business practices. His critique of patents on human embryonic stem cells has been key to expanding the ability of American scientists to conduct stem cell research. He has ensured that California’s taxpayer-funded stem cell research will lead to broadly accessible and affordable medicine and not just government-subsidized profiteering. Prior to joining Consumer Watchdog in 2005, he was executive editor of Tribune Media Services International, a syndication company. Before that, he was deputy editor of USA Today and editor of its international edition. Simpson taught journalism a Dublin City University in Ireland, and consulted for The Irish Times and The Gleaner in Jamaica. He served as president of the World Editors Forum. He holds a B.A. in philosophy from Harpur College of SUNY Binghamton and was a Gannett Fellow at the Center for Asian and Pacific Studies at the University of Hawaii. He has an M.A. in Communication Management from USC’s Annenberg School for Communication.

Says Action Necessary To Restore Faith in Agency As Effective Antitrust Enforcer

Consumer Watchdog today called on the Federal Trade Commission to release the 100-page staff report on the 19-month Google investigation as the only way to “restore a modicum of public trust in the Commission’s ability to serve as an effective antitrust enforcer.”

“I call on you to release the FTC staff report to help make clear what was behind the Commission’s otherwise unfathomable action,” wrote John M. Simpson, Consumer Watchdog’s Privacy Project director in a letter to Commission Chairman Jon Leibowitz and Commissioners Julie Brill, Edith Ramirez, Maureen Ohlhausen and Joshua Wright.

“Media reports suggest that the Commission’s tap on the Internet giant’s wrist was the result of a ‘calculated and expensive charm offensive,’ ” Simpson wrote.

Read Consumer Watchdog’s letter here.

“Put another way, by all appearances, the Internet giant played an insiders’ game and bought its way out of trouble,” Simpson wrote. “Perhaps, the Commission managed to ignore the charm offensive and decide the case on the merits.  Sadly, we cannot know the true situation because we don’t have the details of the 19-month staff investigation.”

Consumer Watchdog’s letter quotes articles in Politico and The New York Times about the Internet giant’s $25 million lobbying campaign and its efforts to cozy up to the Obama Administration and other Washington insiders. “It was a multiyear campaign focused on this very moment, knowing as the company grew these issues were going to come up,” Alan Davidson, Google’s former top lobbyist, told Politico.

Read the Politico article here.

Read The New York Times article here.

The best course of action, Consumer Watchdog said, would have been to file an antitrust suit and bring the case to trial. All the evidence would have been part of the public record.  In a November letter to the FTC Consumer Watchdog warned that a negotiated settlement would inevitably invite cynicism about the results.

Consumer Watchdog’s letter to the Commission today continued:

“Opting to avoid a trial and filing a formal consent agreement would at least have required a complaint, spelling out the violation. Instead you have settled for promises from a company that has a demonstrated record of repeatedly breaking its word.  And it’s not even clear what they did wrong.

“Your only chance of re-establishing the FTC’s credibility on its handling of the Google investigation is to release the 100-page staff report about the inquiry. Releasing the report would put the Commission’s decision in context.

“Moreover, the public has the right to know what the staff recommended and to understand the reasoning of the professionals who conducted the lengthy investigation and the quality of their work.  It could be possible that the staff botched the investigation and you were left with no other choice.  If the report contains Google trade secrets, they could be redacted.”