Alma Whitten, the director of privacy at Google, is stepping down from that role and leaves behind her a complicated legacy in regards to user privacy. Whitten has been the company’s top product and engineering privacy official since 2010 and was at the helm as the company navigated a number of serious privacy scandals and controversies.
Whitten has been at Google for about 10 years, and while she has been the main public face of the company’s product privacy efforts in the last couple of years, she has been involved in engineering privacy initiatives for even longer. Before becoming the privacy lead for products and engineering in 2010 in the aftermath of the Google Street View WiFi controversy, Whitten had been in charge of privacy for the company’s engineering teams. During that time, she was involved in the company’s public effort to fight the idea that IP addresses can be considered personally identifiable information.
In 2008, she wrote a post disputing the idea of IP addresses as PII, and said that in most cases, Web sites and companies such as Google can’t identify users from their IP addresses alone.
“We have proposed broad global privacy standards, and are strong supporters of the idea that data protection laws should apply to any data that could identify you. The reality is though that in most cases, an IP address without additional information cannot,” Whitten wrote.
A Google spokesman confirmed that Whitten is leaving.
“During her 10 years at Google, Alma has done so much to improve our products and protect our users. The privacy and security teams, and everyone else at Google, will continue this hard work to ensure that our users’ data is kept safe and secure,” the company said in a statement.
Whitten will stay in her current role for another couple of months, leaving at the end of June, and will be succeeded by Lawrence You.
During her time as the privacy director at Google, Whitten has had to face several other major controversies regarding user privacy, probably none more public than the Street View data-collection scandal. That issue exploded in 2010 when the company admitted that its Street View cars–which take photos for Google’s detailed map views–had been collecting unencrypted payload data from WiFi routers belonging to private users. In the wake of that admission, Google elevated Whitten to director of privacy and vowed to make changes in the way it handled user data.
“Alma is an internationally recognized expert in the computer science field of privacy and security. She has been our engineering lead on privacy for the last two years, and we will significantly increase the number of engineers and product managers working with her in this new role,” Alan Eustace, Senior VP, engineering and research at Google, wrote in a blog post at the time.
The company recently settled a lawsuit resulting from the Street View WiFi scandal, promising to pay a $7 million settlement to 38 states and Washington, D.C., and to change some of its practices. Another major privacy issue the company faced during her tenure was the reaction to Google Buzz and its privacy policies regarding the social network and user data.
Critics of Google’s privacy policies say that the company did not change much for the better during Whitten’s tenure and that Google would do well to appoint someone internally to watch out for users’ privacy.
“Placing Alma as the director of privacy and the other strict controls that Google claimed it would implement didn’t stop buzz from happening, nor the Safari cookie tampering that led to the 22.5 million FTC fine,” said Chris Soghoian, a privacy advocate and principal technologist and senior policy analyst at the American Civil Liberties Union.
“It is also important to remember. The privacy director’s job is to keep the company out of privacy related trouble. Not to protect user privacy. There is no privacy ombudsman at Google. Perhaps there should be.”
*Image via Marcin Wichaary‘s Flickr photostream, Creative Commons.
