Cases brought against Google in Spain during October for violating Spanish law regarding the collection and transfer of personal information provide an occasion to remind U.S.-based businesses of the need to comply with foreign privacy laws when transferring personal data to the United States from foreign jurisdictions in which they conduct business. Spanish authorities are charging Google for collecting personal information (including names and email addresses) via Wi-Fi "interceptions" by Google Street View trucks and conveying that information to the United States in violation of the Spanish Information Protection Law. The penalties could easily exceed $1 million. These cases are the latest in the ongoing investigations of Google Street View vehicles that were found to be collecting—in addition to street-level photos—data from open wireless networks, some of which included private information.
These cases highlight that any company with business operations in Spain (or any other nation) is potentially subject to similar enforcement actions arising from the collection and transfer of personal information in violation of privacy laws in those nations. U.S. companies must remember that privacy laws in Europe and other areas of the world provide significantly greater protection to personal data about individuals—including both employees and customers—than does American law. (Indeed, the U.S. Federal Trade Commission recently closed its investigation into the data collection from Wi-Fi systems by Google's Street View trucks, finding that Google had improved its privacy procedures and the company had pledged not to use the personal data.)
Adding to the risk is a lack of consistency in enforcement abroad. The United Kingdom's data commissioner concluded that the Street View trucks had not violated U.K. law. Taking yet a different tack, the Canadian federal privacy commissioner held that the Google Street View trucks' collection of personal data from Wi-Fi systems violated that nation's privacy law, but asked only for certain changes in Google's practices.
American companies should be aware not only of the existence and potential sanctions under those laws and the range of interpretations, but also of the availability of a range of legal mechanisms that would allow the transfers of personal information from foreign nations having such laws to the United States or another country in a lawful manner.