US, EU Regulators Look Into Google's Breach

At least two US states and two European Union member states are probing a breach at Alphabet Inc’s Google that may have exposed private profile data of at least 500,000 users to hundreds of external developers.

The investigations follow Google’s announcement on Monday that it would shut down the consumer version of its social network Google+ and tighten its data-sharing policies after a “bug” likely exposed user data that included names, email addresses, occupations, genders, and ages.

“We are aware of public reporting on this matter and are currently  undertaking efforts to gain an understanding of the nature and cause the intrusion, whether sensitive information was exposed, and what step are being taken or called for to prevent similar intrusions in the future,” said Jaclyn Severance, who is a spokeswoman for Connecticut Attorney General George Jepsen.

The New York Attorney General’s office also said that it was looking into the breach.

Google said that the issue was discovered and patched in March as a part of a review of the way Google shares data with other applications. No developer exploited the vulnerability or misused data, the company’s review said.

Another new agency reported on Monday that Google chose not to disclose the security issue because of fears of regulatory scrutiny, citing unnamed sources and a memo that was prepared by Google’s legal and policy staff for senior executive.

On Tuesday, Ireland’s data protection regulator said that it would seek more information from Google regarding the breach.

“The Data Protection Commission was not aware of this issue and we now need to better understand the details of the breach, including the nature, impact, and risk to individuals and we will be seeking information on these issues from Google,” it stated.  

Meanwhile, in Germany, the data protection regulator located in Hamburg, which is the city-state in which Google has its country office, is also examining the breach.

It was doing so because the incident took place before the EU-wide data privacy law took effect in May, paving the way for a “one-stop shop” oversight regime under which Ireland has become the lead regulator for Google.

“We have sent a series of question to Google,” said spokesman Martin Schemm. The Hamburg regulator wants to find out to what extent German users of Googl+ were affected, he explained. Under Germany’s old data protection law, Google would face a maximum fine of 300,000 euros, or equivalent to $345,000.

Under the EU’s General Data Protection Regulation (GDPR), which took effect on May 25, maximum fines run to 4 percent of a company’s annual global turnover, meaning that penalties against the largest Silicon Valley players could in theory run into billions of dollars.

FSMSmart gives you the latest news updates, market trends, and news about forex, commodities, stocks and many more! Open an account now and learn more about other investment opportunities on FSM Smart.