Thursday, August 09, 2007

Diminishing Privacy: Search Engines

With the number of people subscribing to social networking websites such as Facebook and Myspace, it appears that the phenomenom does not stop here. The Beeb has recently published a story indicating the growth of some personal search engines, (Wink.com, Spock.com etc) which would profile individuals and make it easily accessible to anybody:

"The niche search engines are making use of the information that is already out there about us on the web to cross reference details so they can index and build up searchable profiles. Zoominfo.com, which came online in 2001, was one of the first sites to do this. It began life as a subscription service where it gathered profile information from the web in response to requests from recruiters or salespeople, but in 2005 it added a public service, enabling free company and personal searches. Russell Glass, the firm's vice president of products and marketing, said: "Users can come in and search for a person's name, and we essentially crawl somewhere between one billion and two billion pages to gather, organise and summarise a virtual resume." It provides a detailed and rich look at who a person is from a professional perspective." The business-orientated directory contains more than 37 million personal profiles and 3.5 million companies profiles pulled from across the web. Other search engines are aiming for a different market. Some, like Wink.com, a US company that launched in 2006, are using the ever-growing swells of personal information found on social networking sites such as MySpace, Bebo and Friendster in addition to other web sources such as Wikipedia to create public profiles. Michael Tanne, founder and CEO of Wink, said: "The Wink service is where people find people.
"It's targeted at anyone who is trying to find someone else online - old friends, new friends, dates, people they heard or read about, job searches, business leads, celebs etc." Mr Tanne said users could search more than 200 million profiles but added that the company had ambitions to eventually index every person online."

This made me think about the current Data Protection Directive 95/46/EC. Surely, by aggregating personal information from various sources without obtaining individual's consent, would lend itself to a claim that it may fall foul of the Art. 11:

Article 11 Information where the data have not been obtained from the data subject

1. Where the data have not been obtained from the data subject, Member States shall provide that the controller or his representative must at the time of undertaking the recording of personal data or if a disclosure to a third party is envisaged, no later than the time when the data are first disclosed provide the data subject with at least the following information, except where he already has it:

(a) the identity of the controller and of his representative, if any;

(b) the purposes of the processing;

(c) any further information such as

    • the categories of data concerned,
    • the recipients or categories of recipients,
    • the existence of the right of access to and the right to rectify the data concerning him

in so far as such further information is necessary, having regard to the specific circumstances in which the data are processed, to guarantee fair processing in respect of the data subject.

Furthermore, Art. 14 of the Data Protection Directive 95/46/EC (and corresponding national legislation) provides the opportunity for individuals to object to the processing of their personal data.

Certainly a good starting point would be for Data Protection Authorities to start issuing guidelines on social networking and the data protection implications. The Ontario Privacy Commissioner has already issued some guidelines titled "When Privacy gets out of line" (pdf), but more still needs to be done. Furthermore, social responsibility will be the key - if individuals voluntarily put their personal information online, then they are also responsible for the information they share with other individuals. The three Ps, which the Ontario Privacy Commissioners warned students to beware of are quite memorable to remember when going on any social networking website: professors, prospective employers and predators. For such examples, see the recent example of Oxford Dons and Facebook and here.

Some interesting reading:

No comments: