While the bank obviously made a monumental screw up, Google's initial response to the bank is at least in part to blame. Regardless of the privacy rights of the person who's Gmail account it is, there obviously should be an interest in protecting the confidential information of the 1,300 customers.
Google could have responded by helping the bank recover and delete the file, as well as sending an unmissable notification to the Gmail user.
This would set a pretty nasty precedent in which Google would be helping companies delete files from individuals email accounts without their knowledge.
Wouldn't that be the definition of what we'd call Evil?
I think they did the correct and ethical thing by following their privacy policy.
An 'unmissable' notification from Google wouldn't be anymore unmissable than the request email sent by the bank. Which is why the bank wanted Google to disclose the identity of the user. If Google deleted a users emails and disclosed their identity to a third party then Google would be in breach of their own privacy policy. They would be exposing themselves to litigation, hence the requirement for a court order.
Except that it could have ended up, possibly along with the original email, in a never read spam folder. Google has more direct means of reaching an account holder.
Comments
While the bank obviously made a monumental screw up, Google's initial response to the bank is at least in part to blame. Regardless of the privacy rights of the person who's Gmail account it is, there obviously should be an interest in protecting the confidential information of the 1,300 customers.
Google could have responded by helping the bank recover and delete the file, as well as sending an unmissable notification to the Gmail user.
This would set a pretty nasty precedent in which Google would be helping companies delete files from individuals email accounts without their knowledge.
Wouldn't that be the definition of what we'd call Evil?
I think they did the correct and ethical thing by following their privacy policy.
Sure, with a court order. Why should Google randomly delete emails from an account just cause some company/bank asked them to?
The bank already screwed up by not following a privacy policy. That's why they ended up sending private information to a Gmail account.
Google did the right thing by showing the bank what it means to stick to a privacy policy.
An 'unmissable' notification from Google wouldn't be anymore unmissable than the request email sent by the bank. Which is why the bank wanted Google to disclose the identity of the user. If Google deleted a users emails and disclosed their identity to a third party then Google would be in breach of their own privacy policy. They would be exposing themselves to litigation, hence the requirement for a court order.
Except that it could have ended up, possibly along with the original email, in a never read spam folder. Google has more direct means of reaching an account holder.