Government may take legal action against Google

The government is preparing to take additional legal action against Google to force the firm to improve its privacy policy, an agency responsible for privacy protection said Thursday.

The Personal Information Protection Commission (PIPC) told The Korea Times that it would file further complaints against the Korean subsidiary of the search engine giant, unless it complies with a request that the privacy agency sees has “illegal aspects and a strong possibility of misappropriation.”

The agency can impose a fine on Google amounting to 1 percent of its annual proceeds or seek criminal charges.

Google’s new privacy policy took effect in March which combined users’ personal information stored across 60 of its services to create one profile.

“We requested Google to revise the policy last month.” said Kim Young-mun, director of PIPC’s policy review division.

Kim says Google’s Korean office has asked the commission to wait for a reply from headquarters but has not made any changes to the policy.

“There are three key revisions we have suggested. The first is the unclear objective of unifying the information. The policy states that the objective of the unifying will be used to protect Google and its users, which can also mean the company’s business partners.”

He stressed that the ambiguous definition is likely to be interpreted by different parties to fit their own agendas.

“The second is the approval process. The current, service combination allows Google to store all information from separate services with one approval alone. In Korean law, each service requires separate approval.

“The third is the storage time of the data. Users have a right to have their information deleted if they decide to end their subscription to a service, which Google doesn’t allow in its policy.”

The California-based company has added more notifications on its privacy policy to its Korean website in April, adding an additional information menu for those residing in Korea, following the recommendation of the Korea Communications Commission (KCC).

“The added notice on the Korean webpage is much appreciated. However, what the PIPC is demanding concerns the main body of the actual policy and its clauses and not notifications. We are requesting the company change the law itself,” said Kim.

“We recognize that Google’s delay in complying is to a certain extent valid and not unusual for a global firm and its offices in different countries. But if they continue to delay meeting our request, further action by our organization will be initiated and we are discussing the matter.”

Google Korea’s head of corporate communications Lois Kim said that the firm has fully amended its policy according to KCC demands. “We have been cooperating fully with the KCC and PIPC. We are working closely with them to address their questions about our business.” She declined to comment on whether there will be further changes reflecting the PIPC’s recommendation on the actual policy clauses.

The PIPC stated that possible further steps could include administrative and criminal actions but the most likely outcome in the long term if Google continues its stance will be a fine up to one percent of its annual revenue.

The European Union has protested the strongest amid the global anger over the unified policy and is investigating the search engine giant. One legal expert contacted by The Korea Times, who declined to be named, said due to the similarity between the legal system here and there, the Korean government agency has similar authority to investigate Google, and should do so more actively.

Kim Kyung-hwan, a lawyer specializing in the area at law firm Minwho, stated that Google has not fully complied with the KCC’s recommendations and its policies are a vital threat to consumers’ personal information here.

“The KCC’s recommendations did not address the actual policy but rather the process and has a minimal effect on the actual security of information,” the lawyer said via email. “Furthermore, Google only executed part of the recommendation. Compared to Korean policies on Web portals, (Google’s policy) is vastly lacking.”

The lawyer lamented that current Korean laws concerning telecommunications networks and private information protection are too weak in supervising the use of personal information for profiling or combining services for one profile, like those of Google.

Kim says domestic consumers can file a class action against the American firm, as Korean International law on private information protection overrides Google’s user approval articles that state that Californian law will be applied if disputes over services arise.

“Korean law allows compensation, forbidding or halting services, but the combining of services for profiling itself causes no direct damage for now so they will be able to request that the combining be forbidden or halted here.

“However, in the United States, plaintiffs are requesting compensation for misusing cookie information saved on their computers. If combined service profiles cause damage in the future, Korean consumers can file for a lawsuit much like this example.”

As Google’s policy has highlighted the issue of rising global concerns over protection of personal information, the lawyer said that there was need of “safe harbor programs” in Korea with other countries. The program, practiced between the United States, Switzerland and the European Union, acts to mitigate differences between private information laws in different countries. <The Korea Times/Cho Mu-hyun>

news@theasian.asia