The Nation's First Privacy Goalie

Lawyers are a lot like hockey goalies: they tend to receive too much credit for victories and too much blame for losses. Hockey teams are dynamic entities whose game outcomes are largely determined by forces outside the goalie's control: coaching decisions, scoring (or lack thereof) by teammates, inopportune line changes, power play opportunities given to the opposing team, and poor defensive play inside the blue line.

The goalie metaphor is worth contemplating in light of today's news that Nicole S. Wong, a high-ranking attorney at Twitter Inc. and formerly a high-ranking attorney at Google Inc., will be President Obama's choice for the White House's first chief privacy officer.

The CNET article points out that Wong was on the ice when Twitter was recently recognized as a leader among online companies in protecting users from possibly unlawful government information requests. Elsewhere, Wong has been praised as a defender of free speech. Similar coverage here and here.


(photo credit: EddieBPhotos on flickr)

These things reflect well on Wong, though their connection to the job of chief privacy officer is not apparent to me. New York Rangers' goalie Henrik Lundqvist owns Tiny's Restaurant in Manhattan. Does this tell me anything about how he will play tonight? (Poorly, I hope).

So, on the topic of privacy, here are a few pucks that slid near the crease during Wong's tenure at Google (Jan. 2004 to Aug. 2011). The extent to which Wong was involved in any of these plays is anyone's guess. But that's how it goes with goalies. If you're going to get credit for a transparency report that covered only part of the time you were on the ice at Twitter, then you should expect to get scrutiny of the privacy embarrassments and multi-million dollar payouts that took place while you wore Google's jersey.

Buzz, Street View, Apple Safari

This is all pretty familiar stuff.

Launched in February 2010, Google Buzz was a commercial failure and a big privacy problem. Google eventually shelled out $2.5 million to class action lawyers and later settled Federal Trade Commission charges of deceptive trade practices in March 2011.

Then there is Google Street View, launched in 2007, an innovative but terribly insensitive product that created two privacy headaches simultaneously: the first being the collection of public images by roving Google cars around the world; the second by Google's collection of wifi data from receivers hidden in its Street View vehicles. According to the Electronic Privacy Information Center, nine countries have found Google guilty of violating their privacy laws. The Federal Trade Commission and the Federal Communications Commission did not take action against Google, though the FCC fined the company $25,000 for impeding its investigation.

In March 2013, Google settled its Street View troubles with Connecticut and 37 other states for $7 million and a laundry list of privacy compliance chores.

On Feb. 11, 2012, several months after Wong left Google, the Wall Street Journal caught Google surreptitiously bypassing the privacy settings on Apple Safari browsers, enabling the company to track internet activities of those Safari users. The FTC fined Google $22.5 million for this transgression.

Federal Privacy Legislation

During all of the years Wong was with Google, she helped the company promote industry standards as the preferred alternative to federal privacy legislation. Google, along with most of the internet industry, believes that their business is too dynamic to be effectively regulated by a federal statute. Congress has provided ample evidence for this view, having failed to make obvious and necessary changes to two badly outdated laws, the Electronic Communications Act and the Computer Fraud and Abuse Act.

During a Jan. 28, 2010, workshop at the Federal Trade Commission, Wong and other internet industry players told staffers that broad federal privacy regulation is unnecessary because self-regulation is working and that FTC attention on the big online fish is misplaced.

“You have the best players here saying we compete on privacy issues,” Wong said. “As regulators, you should go after bad actors and do more fact-gathering in the shadows before you regulate.”

During a May 7, 2010, event at the Department of Commerce, Wong said that Google saw a role for government to help create international privacy standards. “Consumer expectations are changing, technology is changing, and international standards are changing,” she said. “Privacy is consumer-driven, but it's increasingly part of a much larger global framework.”

Wong identified cloud computing was one of the most significant areas for government and industry collaboration. “There's a presupposition that jurisdiction is about a country,” Wong said. “With cloud computing, this isn't a turf war -- it's about consensus on where jurisdiction should properly end and begin,” Wong said. “This is a key place where the private sector needs government help.”

In June 2009, during a House Energy and Commerce Committee hearing that was exploring a then-little-known practice called behavioral advertising, Wong's written testimony indicated that Google was in favor of efforts to enact a comprehensive privacy law that would, among other things, establish a uniform online and offline framework for privacy and create expectations of privacy from one jurisdiction to another.

Wong also said the company supports an effort by four leading advertising groups—the American Association of Advertising Agencies, the Association of National Advertisers, the Direct Marketing Association, and the Interactive Advertising Bureau—to develop cross-industry self-regulatory principles.

A Stand for User Privacy (and Company Trade Secrets)

In 2006, Google successfully challenged the federal government's bid to obtain thousands of search query strings entered by search engine users. A federal district court agreed with Google that the company's user “trust” in Google would be unnecessarily eroded if Google is forced to divulge this information. (The court also gave some weight to Google's contention that the government request might lead to the discovery of Google trade secrets.)

Wong, in comments posted to the Google blog, wrote that the company will comply with the court’s order. “This is a clear victory for our users and for our company, and Judge Ware’s decision regarding search queries is especially important,” Wong said. “While privacy was not the most significant legal issue in this case (because the government wasn’t asking for personally identifiable information), privacy was perhaps the most significant to our users.”

“What his ruling means is that neither the government nor anyone else has carte blanche when demanding data from Internet companies,” Wong said.

Privacy as Problem

Technology-based advertising businesses such as Google need access to vast amounts of data in order to deliver value to their customers: the companies that purchase advertising products. Privacy laws make gathering and processing data more difficult; and privacy laws can create significant liability for missteps. A cash-rich and data-hungry company, Google is a natural target for regulators and privacy plaintiffs. Privacy is the wolf at Google's door. Wong, who worked so long at Google, a company on the front lines of the information business, can reasonably be expected to have an enormous amount of respect -- but not necessarily affection -- for the world's privacy laws. I see her appointment to the White House's top privacy job as being similar to President Obama's recent selection of former telco lobbyist/investor Tom Wheeler to head the Federal Communications Commission: an experienced official with a deep understanding of the current legal framework, the general drift of the federal privacy policy discussion, and the interests of online business.

Privacy advocates should not expect Wong to make the save in a game in which they have been out-spent, out-hustled, and out-maneuvered for so long. If anything, Wong's appointment gives further momentum to the privacy policy work still going on at the Department of Commerce -- international harmonization and a push for industry codes backed up (perhaps) by an FTC enforcement mechanism.