Shared publicly  - 
 
Okay, in further rebuttal of +Francis Davey, I refer to the original European Directive. Emphasis made to mark where I think the relevant parts of the directive that establish Google Profiles as a public directory of subscribers and Google+ (As compulsorily combined with GTalk) constitutes a communications service.

Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications)
...

(16) Information that is part of a broadcasting service provided over a public communications network is intended for a potentially unlimited audience and does not constitute a communication in the sense of this Directive. However, in cases where the individual subscriber or user receiving such information can be identified, for example with video-on-demand services, the information conveyed is covered within the meaning of a communication for the purposes of this Directive....

(34) It is necessary, as regards calling line identification, to protect the right of the calling party to withhold the presentation of the identification of the line from which the call is being made and the right of the called party to reject calls from unidentified lines. There is justification for overriding the elimination of calling line identification presentation in specific cases. Certain subscribers, in particular help lines and similar organisations, have an interest in guaranteeing the anonymity of their callers. It is necessary, as regards connected line identification, to protect the right and the legitimate interest of the called party to withhold the presentation of the identification of the line to which the calling party is actually connected, in particular in the case of forwarded calls. The providers of publicly available electronic communications services should inform their subscribers of the existence of calling and connected line identification in the network and of all services which are offered on the basis of calling and connected line identification as well as the privacy options which are available. This will allow the subscribers to make an informed choice about the privacy facilities they may want to use. The privacy options which are offered on a per-line basis do not necessarily have to be available as an automatic network service but may be obtainable through a simple request to the provider of the publicly available electronic communications service.
...
(38) Directories of subscribers to electronic communications services are widely distributed and public. The right to privacy of natural persons and the legitimate interest of legal persons require that subscribers are able to determine whether their personal data are published in a directory and if so, which. Providers of public directories should inform the subscribers to be included in such directories of the purposes of the directory and of any particular usage which may be made of electronic versions of public directories especially through search functions embedded in the software, such as reverse search functions enabling users of the directory to discover the name and address of the subscriber on the basis of a telephone number only.
(39) The obligation to inform subscribers of the purpose(s) of public directories in which their personal data are to be included should be imposed on the party collecting the data for such inclusion. Where the data may be transmitted to one or more third parties, the subscriber should be informed of this possibility and of the recipient or the categories of possible recipients. Any transmission should be subject to the condition that the data may not be used for other purposes than those for which they were collected. If the party collecting the data from the subscriber or any third party to whom the data have been transmitted wishes to use the data for an additional purpose, the renewed consent of the subscriber is to be obtained either by the initial party collecting the data or by the third party to whom the data have been transmitted.
...(46) The functionalities for the provision of electronic communications services may be integrated in the network or in any part of the terminal equipment of the user, including the software. The protection of the personal data and the privacy of the user of publicly available electronic communications services should be independent of the configuration of the various components necessary to provide the service and of the distribution of the necessary functionalities between these components. Directive 95/46/EC covers any form of processing of personal data regardless of the technology used. The existence of specific rules for electronic communications services alongside general rules for other components necessary for the provision of such services may not facilitate the protection of personal data and privacy in a technologically neutral way. It may therefore be necessary to adopt measures requiring manufacturers of certain types of equipment used for electronic communications services to construct their product in such a way as to incorporate safeguards to ensure that the personal data and privacy of the user and subscriber are protected. The adoption of such measures in accordance with Directive 1999/5/EC of the European Parliament and of the Council of 9 March 1999 on radio equipment and telecommunications terminal equipment and the mutual recognition of their conformity(7) will ensure that the introduction of technical features of electronic communication equipment including software for data protection purposes is harmonised in order to be compatible with the implementation of the internal market.
2
1
Christian Koepf's profile photoPaul Brocklehurst's profile photoJay Blanc's profile photoAleksi Kilpinen's profile photo
23 comments
 
Out of pure interest. How does Facebook handle the same situation, particulary since it has not only a Common Name but a Real name Policy ? I'm not a Facebook user hence me asking. If G+ constitutes a Messaging/Communication services as you see it (Not so sure myself but plausible) then FB does as well.
 
Facebook actually allows you to hide completely from the search. But as I commented earlier, EU Directives are not law, EU laws are written based on Directives and IMO Google+ is not a communications service, and the search is not a directory.
 
Since Facebook stopped effectively enforcing their policy well before they significantly expanded into Europe, it never became an issue.
 
+Aleksi Google+ also allows you to hide from search..
 
Completely? If that's true - then that's even more reason to say there is no legal problem to start.
/me goes looking for such a setting :P
 
Actually, from what I can find - Name is the minimum to appear on the search on G+. At least that's what it says in my profile settings...
EDIT: I was wrong - I found it :) Thanks for letting me know. It seems G+ and FB both allow you to completely remove your visibility from the search ( the "directory" ) so no problem with the EU regulation even if this was a communications service.
 
+Aleksi Kilpinen You're using the programmer definition of the word 'directory', as a search process on a database. This is not the legal meaning of the word. A directory is a simply a listing of account holders, and Google Profiles is a directory and publishes your name in link to your account even if you do disable searching.
 
so where can I see a listing of account holders then?
 
+Paul Brocklehurst that's easy. Click on anyone's profile image, and you will be taken directly to their published listing on Google Profiles.

The fundamental issue here is that anyone can get your Google Profiles listing if they know your Google+ account. And Google require you publish your 'common name', and in practice appear to demand people use their government photo ID name, in that profile.
 
It would also be trivial for someone to create a webscraper that generated a database of all the profiles of people who have commented on or been +mentioned in any particular account's posts.
 
but that listing can only show their name, if they choose, which gives no information beyond what is already shown on the comment/status; that's not a listing of anything.
 
It's a listing of the name, and Google insist it should be a name you go by in 'real life'. Which if you read the original directive, is indeed personal information that should be at the control of the subscriber.

+Paul Brocklehurst, do you think it is right for Google to be able to force it's subscribers to publish the name they go by in real life and associate it with their Google account?
 
I think the opt out of search provides enough privacy. The 'listing' is neither here nor there. Whether clicking on my name results in a 404 or a blank page with "Paul Brocklehurst" on the top or not is irrelevant.

Now, if you want to argue the case that people are unable to interact on Google+ without revealing their names to the people they interact with, thats a different kettle of fish, but has (IMHO, IANAL!) little to do with the Directive.
 
+Paul Brocklehurst You do understand that once a Google Profile is created, which is mandatory for Google+ use, it is applied to all other Google services on the same account right? So you can be found from any other Google service as well.

The Directive doesn't say anything at all about search visibility being a definition of a directory. A directory is a listing of accounts that identifies personal information, no more no less. Since I can get your listing from a variety of ways beyond the Profiles Search, the argument that it's 'private' if you disable search is spurious.
 
if I have search disabled, how does someone go from my gmail address or youtube account to my Google Profile? If they can, then I see better where you are coming from...

The Directive doesn't say anything at all about a definition of a directory, so I'm not sure you can take what it doesn't say to mean much, btw.
 
Because your 'google account' is now linked indelibly to your 'google profile'. And google profiles are being rolled out across all of Google's services. It appears that new gmail accounts require a profile, and they intend to do the same for everything else.

And again, words not specifically defined in legislation take their broadest (unless contrary to legislative intent) common meanings at the time it was drafted. The legislative intent, to protect personal privacy and allow for pseudonymous public identification, is explicit in the original EU directive.
 
Actually, I see no explicit intent to allow for pseudonymous public identification - That directive has nothing to do with such. It is only meant as a way to regulate the way service providers handle personal information submitted to them. In other words, it is basically saying thateven though I must give my personal data to a service, I should be able to limit the usage of that data to relevant purposes only. Nothing in it to say I should be allowed to use a pseudonym instead.
 
you didn't answer my question Jay. 'linked' in what way? how do I get to someone's Profile from their gmail address?
 
+Aleksi Kilpinen "It is necessary, as regards connected line identification, to protect the right and the legitimate interest of the called party to withhold the presentation of the identification of the line to which the calling party is actually connected, in particular in the case of forwarded calls." establishes explicit legislative intent.
 
That part is explicitly aimed at land-line phone services. I see no relation to Online services otherwise.
EDIT to add: By the way - I fully support the right for pseudonymous usage. I'm not fighting that at all.
 
+Aleksi Kilpinen It isn't actually, they just use the word 'line' because they didn't have a different word for 'connection of communications for a communications service'. There doesn't have to be a physical line, and the directive refers to this in situations where a physical phone line doesn't exist.

Again, the directive makes it explicit that it's legislative intent is meant to apply to all the new kinds of service on the internet as well.
 
That would be speculation really - Plus, only the directive can not be used to rule such a case. It would have to be judged on local Law, which would have to be better defined, OR ruled in favor of the defendant. In this case G+.
 
+Aleksi Kilpinen No. It is not speculation.


"(4) Directive 97/66/EC of the European Parliament and of the Council of 15 December 1997 concerning the processing of personal data and the protection of privacy in the telecommunications sector(5) translated the principles set out in Directive 95/46/EC into specific rules for the telecommunications sector. Directive 97/66/EC has to be adapted to developments in the markets and technologies for electronic communications services in order to provide an equal level of protection of personal data and privacy for users of publicly available electronic communications services, regardless of the technologies used. That Directive should therefore be repealed and replaced by this Directive.
(5) New advanced digital technologies are currently being introduced in public communications networks in the Community, which give rise to specific requirements concerning the protection of personal data and privacy of the user. The development of the information society is characterised by the introduction of new electronic communications services. Access to digital mobile networks has become available and affordable for a large public. These digital networks have large capacities and possibilities for processing personal data. The successful cross-border development of these services is partly dependent on the confidence of users that their privacy will not be at risk.
(6) The Internet is overturning traditional market structures by providing a common, global infrastructure for the delivery of a wide range of electronic communications services. Publicly available electronic communications services over the Internet open new possibilities for users but also new risks for their personal data and privacy."

Remember, this directive is a replacement for the previous directive that was focused on fax, land-line and mobile phone services. Some language that seems weird is carried over from those.
Add a comment...