As a citizen of the United States, I have more reason for concern. Lately, federal and local law enforcement has been a lot more curious about what Google’s users have been doing online. Between January 2011 and June 2011, the most recent period that Google has records for, government requests for user data were up 29% over the previous six-month period.
This increased curiosity is not limited to the United States. Requests in Spain were up 28%. In Germany, that figure was 39%.
According to Google, once the company receives a request, it reviews it and only provides information “within the scope and authority of the request.” Well, that scope might be a lot bigger now that Google’s new policy is in effect.
Previously, you were either a YouTube user or a Picasa user or a Gmail user. Now, you are a Google user. That could have serious repercussions if the FBI ever comes knocking on Google’s door for your information, at least according to Marc Rotenberg, executive director of the Electronic Privacy Information Center (EPIC).
“Let’s say you have subpoena of records for someone who might have posted something to YouTube,” Rotenberg says. “Traditionally, you might limit that subpoena to YouTube activity, because that’s what is relevant to the investigation. What Google has done by combining user data is basically make all of their activity on Google potentially relevant to an investigation.”
“As a practical matter it makes it easier for Google to disclose a lot of information it wouldn’t have disclosed before.”
A Google spokesperson told me in an email that the company’s policy concerning user data requests will not change after the transition:
Like all law-abiding companies, we comply with valid legal process. We take user privacy very seriously, and whenever we receive a request we make sure it meets both the letter and spirit of the law before complying. When possible and legal to do so, we notify affected users about requests for user data that may affect them. And if we believe a request is overly broad, we will seek to narrow it.
The spokesperson did not, however, address my question as to whether or not government agencies will have to file separate requests for different Google services or if they’ll only have to file a single request for a consolidated record of a user’s activity across various Google products.
It’s also important to remember that this is a global policy change. France’s National Commission for Computing and Civil Liberties is already challenging Google, saying its new policy violates EU law.
As we saw in the Arab Spring, the internet can play a big role in helping a burgeoning political movement gain steam. How will Google react when governments in profitable markets start asking for these new, more complete user records? The line between investigating “criminal matters” and political opposition is thin, and in the past, many government officials have shown no hesitation in crossing it.
UPDATE (6:26pm): Google has sent the following statement: