Google sued for data-mining students' email

http://nakedsecurity.sophos.com/2014/03/18/google-sued-for-data-mining-students-email/

by sp8 • 12 years ago

65 62 12 years ago

nakedsecurity.sophos.com

The plaintiffs are seeking payouts for millions of Gmail users. The financial damages would amount to $100 per day of each day of violation for every individual who sent or received an email message using Google Apps for Education during a two-year period beginning in May 2011.

So assuming at least 1 million users, they are seeking:

1,000,000 users * $100 per user * 365 days per year * 2 years = ~ $73 billion in damages.

I'm not commenting on whether data-mining on Google's part was right or wrong, but why isn't there any limit to the amount that companies can be sued for?

It seems impractical for the people suing to sue for around 73 billion dollars when the product/service is essentially free.

dagw2• 12 years ago

Initial damage claims are often made on the assumption that once all appeals and negotiations are done you'll be very lucky to walk away with even 5% of the original number.

ronaldx• 12 years ago

The cost of the product is surely irrelevant here: If the product damages your life (in an unexpected way), you should be able to sue to recoup those damages.

In this case, presumably the individuals may have been signed up to Google Apps for Education without their direct consent (or, it was an unstated requirement of their courses to sign up).

Also note: companies have access to liability insurance to cover them for being sued out of existence. Google presumably have a budget for lawsuits.

Tomdarkness• 12 years ago

My experience with Google Apps is when you create a new user the first time they log in they are presented with the T&Cs they have to agree to before they can use the account.

izzydata• 12 years ago

The problem seems to be that there actually haven't been any damages. Not a single person has been negatively affected by these targeted ads and nobody has had their personal information actually read. They have no chance with this lawsuit.

jw2013• 12 years ago

Gmail is free to you, but their ads can earn more money by mining the info in your email. Is this really free here? Your email content has value.

morganvachon• 12 years ago

Exactly. If anything, Google should pay the user for the privilege of mining their email. Maybe not much, since they do provide such a useful service, but even $20 per year would be pennies on the dollar for the value of the user's info. It wouldn't be enough for me to start using their service again, but for a lot of people it would be.

josephlord• 12 years ago

but why isn't there any limit to the amount that companies can be sued for?

Because there is no limit on the damage that they could have done (regardless of the cost of the service). In many cases non-customers may be harmed (e.g. Deep Water Horizon) so there is no relevance of the cost of the service to the amount of potential damage that can be caused.

I'm not claiming that this claim is reasonable or that the amount of damage claimed here is remotely correct.

mike-cardwell• 12 years ago

Small companies can be sued into bankruptcy. Why should large companies be exempt?

rayiner• 12 years ago

There are two premises behind imposing damages in civil suits:

1) Restitution for the injured parties. Hard to measure in a case like this, but you can essentially think of this as the digital equivalent of conversion (i.e. using someone else's property for personal profit without permission). So the fair restitution might be whatever dollar figure the person would have been willing to have been paid to have that information data mined.

2) Deterrence of harmful behavior. The proper measure for this should be (dollar amount of profit from choosing the harmful course of action) / (probability of getting caught). I.e. if you do something harmful and profit $10 million, and have a 10% chance of getting caught, then assessing restitution and punitive damages of $100 million makes taking the harmful course of action economically irrational.

An arbitrary cap, or a cap based on the price of the product, is not relevant to either measure.

Zenst2• 12 years ago

Firstly the EULA (which nobody reads) does cover this and then the aspect of you get what you pay for and again their choice compeletely how they wish to spend thier money, or not in this case as it is a free service they are using.

Also the cusomised ad advertising is an option you can opt out of, so once again I'm not understanding the issue here beyond grabbing some headlines for mistakes that were avoidable on many levels.

lumpygravy2• 12 years ago

Also the cusomised ad advertising is an option you can opt out of, so once again I'm not understanding the issue here beyond grabbing some headlines for mistakes that were avoidable on many levels.

As far as I understood from previous coverage and reading the privacy policy, the point is that e-mails are mined even if ads are turned of for the domain. The resulting profiles are then used for showing contextual advertisements in services that are not in Google Apps (e.g. Google search and Google+). Google's lawyers have also admitted that this is true. IANAL, but reading the privacy policy and the ToS for Business accounts, it seems to be the same there.

Of course, you can completely opt out of interest-based ads, both on Google services as on Google ads across the web. But I assume that profiles are still built, if not used.

A related problem is that persons sending e-mail to a GMail address (which could be hidden behind a non-gmail domain) never consented to the ToS and their e-mails are profiled. To which Google's reaction was: "all users of email must necessarily expect that their emails will be subject to automated processing." [1] IMO there is a difference between scanning e-mail for spam and viruses, and using the content to build a profile of the sender or receiver.

[1] http://www.theguardian.com/technology/2013/aug/14/google-gma...

Oletros4• 12 years ago

Do we have a proof that Google profiles non Gmail users?

Take into account that process the email is not the same that profiling that user

Houshalter4• 12 years ago

If you send an email to a gmail user of course you are consenting for their email service to process the email. Things like spam filtering and preloading images depend on this.

onion2k3• 12 years ago

You could be consenting for the email service to do reasonable processing on each individual email (eg filtering and preloading). Sending an email doesn't necessarily have to give the receiving agent permission to build a profile for the specific sender that maps all the emails they send to the service to multiple, separate recipients on to a single graph.

Also, with Google's "Google Apps for Business", a user can use their own domain for their email. Sending someone an email doesn't inform the sender that they could be contributing to a Google profile.

magicalist4• 12 years ago

You can send me an email and I can do quite a bit with it at that point, regardless of what you want me to do with it. That includes generating ads for me to look at to pay for my free email. You might have a copyright claim, but the implied license you give by sending me that email would go quite far.

dagw2• 12 years ago

How do I know whether someone is a gmail user or not when they're using their own domain?

aDevilInMe• 12 years ago

You can check out the mx settings for the domain using one of the free online tools. If they have already sent you a message then you can look at the raw source of the email to see who and how it was sent.

mattmanser2• 12 years ago

If you send a letter to an address of course you are consenting for the postman to read your mail.

This is all about moving from offline to online.

In the ancient days pre-email it was a non-trivial task to read every single letter being sent in a country, categorize them all and then profile people based on them.

And the countries that did that weren't somewhere you wanted to live.

In the modern age it's a "feature" that companies provide because "if you're not paying for it, you're the product".

Not that I think it's necessarily bad, but boundaries have to be set for this new age and this law suit is simply part of that process. Just look at it from a different perspective.

(And note that spam filters & image preloading are problems that only need to be solved because of the same new trivial cost of automated malicious actions)

Houshalter4• 12 years ago

If you send a letter to an address of course you are consenting for the postman to read your mail.

It's more like if the person you are sending to hires an assistant to sort and organize their mail for them (which people actually do.) You then go and sue the assistant.

cottonseed• 12 years ago

For a long time I had used an email that forwarded to gmail. Nobody who used that email would know it was going to gmail. (I have mostly moved away from Google product since.)

account99282• 12 years ago

The suit maintains that, because such non-Gmail users who send emails to Gmail users never signed on to Google's terms of services, they can never have given, in Google's terms, "implied consent" to scan their email.

This. One victim is the private mailing list: There's always at least one sap who subscribes using google mail.

My personal hope is that suits like this will one day push them to discontinue gmail.

scrollaway• 12 years ago

Oh, look, a troll.

thaumasiotes2• 12 years ago

But this is nonsense. The sender doesn't need to consent; the recipient has all the legal power over his mail. If I want to engage a company to keep files on all my paper mail, and all associated metadata, there's nothing you can do to stop me.

e12e• 12 years ago

If I want to engage a company to keep files on all my paper mail, and all associated metadata, there's nothing you can do to stop me.

(my emphasis)

Well, in Norway I could report the company for storing personal data without a license to do so. Essentially any database (even list of phone numbers[1]) that contains personal data (name, contact information, any other information) is regulated. The laws have been somewhat modernized, so that it is assumed that it is ok for a school to give out (and keep) contact information to households/parents of a class -- or for a business to keep a database of customers, for example -- but you most certainly are not allowed to "just keep a lot of data on people because you can".

If you were to do it as a private person, you would most likely never get caught, of course -- but as a business you'd essentially be committing a crime -- and could face (rather steep) fines.

This is why Norway (along with a few other European countries) have taken a rather dim view of Facebook -- and note that with Facebook, users do consent in general (barring the shadow profiles, information uploaded by users regarding non-users etc).

facepalm3• 12 years ago

What do they mean by "Google is reading our mail" - has Google reached sentience?

Just to display it on GMail, one of Google's servers has to read the mail. If they claim that Google has achieved sentience, the implications could be very far reaching...

I mean perhaps this lawsuit will clarify when algorithms will be considered sentient.

bowlofpetunias• 12 years ago

It's interesting how corporations are only people when it's convenient.

throwaway20482• 12 years ago

the exact same arguments could be applied to the NSA

facepalm3• 12 years ago

Except that the NSA doesn't have a website for checking my mail and I am not explicitly sending my mail to them.

hamax• 12 years ago

If they would be an email provider, yes.

joshuaheard• 12 years ago

By "reading" I think they mean analyzing the content versus merely serving up text.

driverdan• 12 years ago

Original, non-blogspam article: http://www.edweek.org/ew/articles/2014/03/13/26google.h33.ht...

Original HN post: https://news.ycombinator.com/item?id=7427368

LammyL• 12 years ago

It is really interesting how people get so concerned when google "reads" their email to target ads at them, but they expect google to "read" their email to filter spam. The machine act of text processing of the email is same in both cases, yet only one is offensive to users.

Google sued for data-mining students' email

Related Stories