Google hit with privacy allegations as its I/O conference kicks off

Last September, Mohamed Maslouh, a London-based employee of HR giant Randstad, was tasked with entering potential job candidates’ public LinkedIn data into Google’s internal applicant tracking system, gHire. Randstad had trained Maslouh in the EU and U.K.’s General Data Protection Regulation, so when he saw old personal data—dating back as far as 2011—in gHire, he knew something was wrong.

The GDPR says companies can only hang on to someone’s personal data for as long as it’s really, really needed. In the case of recruitment databases, that generally means weeks or a few months after the application process closes. It does not mean several years.

As detailed in my story about Maslouh’s revelations, which we published today, Google says it has now implemented a global deletion tool to bring gHire into compliance with the GDPR and other legal frameworks. The rollout ended after Maslouh discovered the old data, so much of it has apparently now been deleted. 

However, the GDPR came into effect in May 2018, so it could well be that Google was breaking the law for several years. And as data-protection lawyer Michael Kissler told me, the complexity of Google’s deletion tool—which apparently meant it took years to develop—is not much of an excuse. “If it takes them so long to be in line with the law then it’s their problem,” he said.

Incidentally, one of the people whose privacy rights were seemingly violated also happens to be a European privacy lawyer, named Nendenie Lachman. Does she think Google met the GDPR’s requirements in the way it managed job candidates’ data? “I have my doubts,” she told me.

The big question now is whether the U.K. and Irish data-protection authorities confirm the violations and penalize Google. Maslouh has filed protected whistleblower complaints with both. However, while the GDPR theoretically comes with big teeth—fines can go as high as 4% of global revenues—enforcement is patchy, which is according to Kissler why so many companies think they can risk noncompliance.

Google has already received fines over other GDPR violations from authorities in France, Spain, and Sweden. Perhaps those were not the last.

More news below.

Want to send thoughts or suggestions to Data Sheet? Drop a line here.

David Meyer

Data Sheet’s daily news section was written and curated by Andrea Guzman. 

NEWSWORTHY

Twitter’s newest show. Former Fox News host Tucker Carlson will relaunch his show on Twitter. Carlson’s new gig comes after he was dismissed from the network, following a $787.5 million defamation settlement with Dominion Voting Systems. Now, Carlson’s lawyers have reportedly accused the network of breach of contract and fraud. Twitter CEO Elon Musk welcomed Carlson, saying that the platform lets people “interact, critique, and refute whatever is said.”

Uber can now arrange flights. Through a partnership with flight booking app Hopper, Uber users in the U.K. can now book domestic and international flights on the app. The service is expected to expand in the next few weeks, but it’s unclear if Uber is bringing the feature to customers in the U.S. or other countries.

The first commercial space station. Space station startup Vast is aiming to put the first commercial space station in orbit using a SpaceX Falcon 9 rocket in August 2025. The station will be known as Haven-1, and will initially act as an independent crewed space station before connecting to a larger Vast space station that’s in development. After the mission on Falcon 9, a SpaceX Dragon spacecraft and a four-person crew will orbit Earth for up to 30 days. The first mission is available for booking, with Vast saying customers can be domestic and international space agencies and others involved in science and philanthropic projects.

SIGNIFICANT FIGURES

5

—The number of years until a Sam Altman–backed startup, Helion Energy, says it will have built the first fusion power plant. Experts are skeptical that a commercial plant could be running by then, and the company has declined to say whether it has reached milestones of achieving scientific or engineering gain. But others are betting on its success. Microsoft has signed a power purchase agreement to buy electricity from Helion in just a few years.

IN CASE YOU MISSED IT

‘Classic rush to judgment’: Sam Bankman-Fried seeking to dismiss all but 3 criminal charges, by Leo Schwartz

Ferrari may eventually make an EV, but it has zero interest in self-driving cars: ‘We don’t care,’ by Tristan Bove

Bill Gates opposes Elon Musk’s call to pause new A.I. research because of what ‘bad guys’ could do with the technology, by Tristan Bove

IBM brings back Watson as A.I. heats up, by Chris Morris

After terminating a program to pay creators, Meta says it’s expanding tests to compensate creators on Facebook Reels, by Alexandra Sternlicht

BEFORE YOU GO

A.I. you can date. Using 2,000 hours of an influencer’s now-deleted YouTube content plus OpenAI’s GPT-4 API, a companion avatar that’s an extension of Snapchat influencer Caryn Marjorie acts as a girlfriend for users willing to pay $1 a minute.

Known as CarynAI, it’s been charging users for a week in beta testing and has already generated $71,610 in revenue. It’s the first romantic companion avatar from A.I. company Forever Voices, which has made chatbot versions of Steve Jobs, Taylor Swift, and Donald Trump that are also available for pay-per-minute conversations on Telegram. But CarynAI says it can create a real emotional bond with users. If it already sounds like the 2013 movie Her, our test of CarynAI found that the tech will share intimate feelings and engage in sexually charged chats. But there are still limitations. Fortune reporter Alexandra Sternlicht says to think of her as an intimacy-ready Siri rather than a virtual girlfriend.