privacy in particular protecting privacy
is tough as you all well know it's tough
technologically it's tough socially and
it's tough legally and it won't come as
a surprise to anybody in the audience to
hear the we at Google have had our
challenges over the years we've we've
made our mistakes we launched Google
Buzz without designing as well as we
could have we launched Street View in
some countries which we've got a mixed
reception and we collected Wi-Fi data by
mistake that said we live in Silicon
Valley we pride ourselves on the ability
to learn from mistakes to launch and
iterate and to get things right
eventually I'm happy to be here at ia
PEEPi to discuss some of the things
we've learned over the years to talk
about the intersection between the
information revolution and privacy and
to share some perspectives on how
government policy can help us get it
right we at Google have had to evolve
our attitude and our approach on privacy
issues particularly in Europe we've
needed to do a better job of listening
to and understanding concerns raised by
data protection authorities and others
we're now engaging with European
regulators to improve our compliance
with European data protection laws and I
think it's fair to say that we have put
in more work than any other company out
there in meeting these sometimes
challenging legal requirements I hope
that our our implementation of the
recently decided right to be forgotten
decision in Europe shows that we are
willing to adjust our course when it
comes to privacy the Castella ruling
established that search is subject to
European data protection law and broadly
outline various obligations regarding
the removal
and search we've been working hard to
implement the decision some of the
decisions are easy some of them are very
difficult as we weigh the balance
between privacy rights and the public's
right to know our approach has largely
been consistent with the recommendations
of European experts and regulators but
they're still disagreement around the
scope of issues like whether the scope
of removals should be global or focused
on Europe conflicts of law and
jurisdiction are never easy
since the fundamental rights at stake
are sometimes weighed differently in
different countries and different parts
of the world but despite these
differences we have some big reasons to
get this to get privacy right there's no
way around the fact the data analysis
what we call smart data is a key driver
of today's economy and tomorrow's growth
like light data is a renewable and a non
rival risk resource using it well fuels
innovation than all parts of the economy
of course data comes from many sources
some data is pre-existing what's in our
genes our bodies our environment the
world has always been full of such facts
and some data we create ourselves
through a whole new world of
computerized transactions and the
growing world of the Internet of Things
it's important to step back and remember
that until the year 2000 mankind had
created and stored roughly 12 exabytes
of data in total an exabyte is a lot
it's roughly the amount of information
in the US Library of Congress so twelve
exabytes in human history up to twelve
thousand 2000 today the world creates
and stores roughly two exabytes of data
every single day 90% of the data in the
world has been created in the last two
years alone that's 2.5 quintillion bytes
of data every day a way to think about
that is creating a new Google every
for days and the rate is increasing in
just one example YouTube users upload
hundreds of hours of video every minute
in total that's more than all cinema all
TV all home movies ever made believe it
or not the data the facts alone aren't
really the interesting part
they've always been lots of facts in the
world raw data is to knowledge what's
and is to silicon chips data without
insight is pretty worthless it's data
used well smart data that lets you build
a bigger picture a kind of integrated
knowledge we are just starting to unlock
new troves of understanding with huge
social value and it's not just online
companies reaping the benefits it's
small businesses selling more and
wasting less consumers getting more of
what they want faster universities and
research hospitals revolutionising
health care through genetics Diagnostics
personalized medicine and maybe most
importantly poor people around the world
being included in a global trading and
information economy with an
unprecedented billion human beings
coming out of extreme poverty in the
last 30 years that is unprecedented in
the history of mankind we are also
seeing data-driven innovation in our
daily lives personalized learning gives
real-time feedback and assessments to
help with student proficiency
de-identified data sets from hospitals
are helping improve healthcare
efficiency and outcomes data about the
location of assaults is facilitating
targeted interventions to reduce violent
crime so let me stress our deep belief
the data driven innovation is compatible
with privacy in fact the two must go
together there's a path to data security
and access control reasonable user
awareness
Powerman data portability that will let
us achieve both privacy and innovation
of course overly rigid restrictions on
combining and repurposing data strict
prohibitions on data transfer or overly
detailed consent requirements could
create challenges for the growth of
data-driven innovation blanket
prohibitions on data collection and
transfer necessarily limit innovation
it's the misuse of data not its
collection per se that should concern us
most of course in arguing for an
approach focused on avoiding harms we
are required to also face up to the need
to keep collected data safe and secure
so as to avoid the harms that can flow
from data breaches and unlawful access
so how do we see those challenges at
Google how do we meet privacy and
security expectations of users around
the world complying with law is
obviously a baseline requirement and
we're working hard to make sure we get
it right beyond that however we also
have to contend with a simple fact that
privacy means different things to
different people in different situations
and in different cultures there's simply
no one-size-fits-all solution or easy
answer here that's why we work hard to
put the user in control people want to
be in control the information they share
and want to have choices about the
services they use that takes a lot of
engineering work privacy by design not
just in the creation of new products but
in the operation of your daily business
a few examples first user controls our
user dashboard lets you see the
information stored by Google and access
all your privacy settings from one place
you can see the people you've shared
documents with the apps you've
downloaded to your phone much more
people are using these tools and
understanding the choices they're making
10 million people check out their
account history settings each week and
they make roughly two and a half million
changes to those settings roughly evenly
split between people turning on settings
and turning off settings
keeping a record of what you search for
can improve the quality of some results
but if you want to search without your
queries being stored turn off search
history it's just that easy knowing your
location helps us give directions
without having you having to type in
your current location that's great for
people like me who have a hard time
typing on small screens but you can
always turn off location as well we take
pride in letting people leave Google
easily it's a little counterintuitive
but we think it's the right thing to do
and in the long term builds trust and
quality of our services data portability
matters so we built data take out a tool
that lets you export and remove data
stored by Google and import it to
another service we want people using our
services because they love them not
because we somehow hold their data
hostage now I also want to stress the
importance of security I noticed a
privacy conference but I also know that
this audience understands better than
perhaps anyone that data privacy and
data security are not at odds with each
other there are two sides of the same
coin you can't have privacy without
security your data just isn't private if
it isn't secure we can see too easily
what happens to privacy when security
fails the celebrity hacks of late last
year are a clear example of the risks
people using the iCloud service were
victimized likely through a
sophisticated phishing or malware attack
and consumers are clearly worried about
breaches a recent poll in the u.s.
showed that more people are concerned
about being hacked than about having
their house robbed the FTC once again
found last year that identity theft a
typical outcome when data security goes
wrong was the leading consumer complaint
in 2014 for the 15th consecutive year
that's why we invest so heavily in
strong account protections and encourage
others to focus more on this area anti
hijacking systems have reduced the
number of compromised Google accounts by
more than 99 percent since we introduced
them in 2011 by blocking sufficient
suspicious login attempts if you've ever
traveled to a new place and got a gmail
about a recent login that's our system
at work we were one of the first
companies to offer the additional
protection of two-factor authentication
across our accounts even if a hacker has
your password he or she likely doesn't
have your phone or security key so
getting into your account becomes much
harder our Safe Browsing technology
scours the web for sites that try to
steal passwords or contain malware you
may have seen one of the very visible
warnings we show when someone tries to
navigate to a malware that malicious
page and you're not alone we're
currently showing 20 million warnings
per week we make this data freely
available to the public and other
companies and since both Apple Safari
and Mozilla's Firefox browsers use it
taken together we help protect 1.1
billion people around the world from
attacks we also stopped all ads pointing
to sites where we find malware last year
alone we remove more than 250,000 sites
from our ad network for hiding different
kinds of Mellor but the internet
interconnected nature of the web means
that security is not just something one
company can do by itself vulnerabilities
of one system can create a launching pad
for attacks on others that's why we're
working to improve the state of the web
ecosystem we're at large for example in
an effort to engage other sites to use
encryption we now rank the encrypted
websites slightly higher in our search
results also I know you've been hearing
a lot about encryption at Google we've
significantly in critics panda dauer use
of encryption which helps safeguard
fundamental human rights like privacy
and free expression encryption requires
governments including the US government
to go through proper legal channels to
request the data they need for an
investigation rather than relying on
mass surveillance Google was the first
email service to be encrypted by default
and Google search drive and maps are all
encrypted
we've encrypted dated moving internally
between our servers a project we
accelerated in the wake of the Snowden
revelations and we're working to extend
the encryption to more of our services
every day
of course the private sector can't do it
alone governments have a responsibility
to protect their citizens and an often
pressing need to review private
communications in the course of
investigating crimes make no mistake we
recognize that we have a legal and moral
responsibility to protect the privacy
and security of our users data at the
same time we want to be responsible in
helping government's keeping people safe
we're committed to both goals so we work
with governments in ways that are
countable and transparent governments on
both sides of the Atlantic are
suggesting that they need access to
encryption keys or other forms of
backdoor access to user information in
our view encryption doesn't just protect
against bad guys it directs governments
toward the front door using established
legal process so we need to make the
front door work better not build
backdoors it's always been true that
technology can be used used for good or
for bad ever since people discovered
fire there's been arson but since most
people the overwhelming majority of
people use the internet for good and
legitimate ways we shouldn't weaken
security and privacy protections for the
majority to deal with the minority who
dump that's why in both emergency and
non-emergency situations we review every
single data request that comes to our
door to ensure that they comply with the
law and are not over broad our
transparency report that we were the
first to publish shows that we are often
pushing back on requests that we receive
that's also why in non-emergency
situations data requests especially for
private communications like Gmail must
always come through appropriate channels
like mutual legal assistance treaties
and what's which create processes for
one government to request data stored by
a company from another country still the
EM lap process is too slow too
complicated and in need of reform for
example it would save everyone time if
we move beyond fax machines and
diplomatic pouches red wax and sealing
ribbons to web forms that are quick and
easy to process
Europe is leading the way here and we
now need the US government to follow
suit and it's time for governments to
step to consider changes to
international agreements that would make
data access contingent on the physical
location of the person rather than the
location of the data improving illegal
channels for governments to obtain data
is very different than permitting mass
surveillance prism and other programs
that were recently revealed
we're damaging for the entire internet
ecosystem and for the US government's
relationship with Europe and other
regions of the world
we don't want technology companies
mistakenly viewing viewed as doing mass
surveillance that is just not the case
but the revelation sparked a very
important debate about privacy and
security in the context of government
surveillance we need to find a
reasonable middle ground as we progress
that debate one that restricts
indiscriminate surveillance and aides
valid law enforcement efforts while also
protecting people's privacy and keeping
their data secure we need surveillance
reform including ecto reform in the
United States we need encryption and we
need better mechanisms for sharing data
between governments for legitimate law
enforcement purposes and as we continue
to press for surveillance reform it's
also crucial crucial that we continue to
support the successful revision of the
us-eu safe harbor agreement and other
international agreements that facilitate
data flows the safe harbor agreement and
apex cross border privacy rules provides
that a legitimate transfer of data in
the cloud these programs help not just
for big upstarts but for small upstarts
as well they facilitate interoperability
solve applicable law conflicts and give
countries sorry companies an operating
baseline by setting the standards for
the transfer and protection of personal
data these kinds of sustainable transfer
models are critical to cross-border data
flows and of the worldwide increasingly
data-driven economy finally I'd like to
say a few words about the recent White
House draft privacy bill the US has
demonstrated in this past week that it
continues to work in developing
legislation
that strikes the right balance between
protecting the rights of consumers and
allowing for data innovation we applaud
the efforts of the administration for
kicking this off and for making it clear
that this is a discussion draft figuring
out the details will be difficult it's
encouraging that the administration is
welcoming an active discussion to
improve on what they've put forth it's
time for people to start considering how
the details of this bill or any bill
would work in practical terms do they
effectively address privacy risks and
real horns do they promote the kinds of
transformative data-driven innovation
that we've been discussing today as I
noted at the outset privacy protection
is one of the most difficult and
important social technological and legal
challenges we face today we've learned
from experience it can be hard to apply
privacy protections when privacy can
mean so many different things to
different people in different contexts
that's why we put users in the driver's
seat through settings and controls
Portability and security we're working
hard to apply sometimes challenging
legal requirements working hard to make
the web a safer place for everyone not
just our users and working hard for
surveillance reform and progress on data
transfer rules the bottom line is that
people around the world are benefitting
from smarter uses of data to solve
problems big and small it has never been
more critical than all of us individuals
companies and governments remain
committed to solving these problems and
to getting privacy and security right we
work look forward to working with all of
you toward that goal thank you very much
were you really wise