Last November, Google acquired Fitbit for $2.1 billion and before the ink could dry on the dotted line, regulators and advocates began to cast their eyes toward potential privacy and antitrust issues.
Google sought to assuage these concerns in Europe by bringing forth a package to the European Commission. In the package, Google offered a series of commitments for how it would use users' Fitbit data. Google promised it would not use Fitbit data from the European Economic Area for targeted advertising, to maintain data silos for Google and Fitbit information and other commitments centered around web and Android application programming interfaces.
The European Commission accepted these commitments, and thus commenced a search to find an organization to keep tabs on Google over the allotted 10-year monitoring period. The company tapped for the role just so happens to have its flag firmly planted in privacy.
ING Bank, the monitoring trustee for the acquisition, has tapped Sentinel to serve as Technical Expert for the Google-Fitbit deal. In this position, Sentinel will ensure Google honors its commitments and inform ING of all developments as it makes submissions to the European Commission.
"We’ve been spending the last few weeks with Google, ING and some of the Fitbit engineers, looking over the shoulder at some of the ways that this will be implemented, understanding first from a high level, but then really getting down with some deep-dive meetings with the engineers who are responsible for these different areas and looking through how these things are working," said Sentinel President and Co-founder Aaron Weller, CIPP/US, CIPM, CIPT, FIP.
Google's outside counsel approached Sentinel to be a potential candidate for the role back in January, a month after the European Commission agreed to the technology company's commitments. ING and Sentinel reached an informal agreement for the privacy tech vendor to serve as Technical Expert in March, and the work began.
Sentinel will be tasked with providing biannual reports on Google's practices, with the first one due in July. That doesn't mean the processes and procedures are set in stone. In fact, that couldn't be further from the truth.
"Because Fitbit and Google still have separate data stores, some of the things are still in process," said Weller. "We can look at the plans, but the systems aren’t in place yet, because the data isn’t in a state where it would be used for those purposes. In those cases, we are looking at what is available today and understanding that timeline, because this is a 10-year commitment, so every six months for ten years, we will be going and assessing what those different areas are looking like."
Weller said one of the challenges Sentinel faces will be working to stay on top of the changes that will almost certainly occur during the 10-year period. Google's ads will change. Fitbit's devices will change, and the personnel at the two companies, and Sentinel, will fluctuate over the decade. A lot will change even from report to report. The information Sentinel provides in July will likely be more abstract than the one they will deliver in January as Google and Fitbit establish their new arrangement.
Another area where Weller expects to run into some resistance involves the complexity of the commitments. Weller likens reading the commitments to the first time he delved into the EU General Data Protection Regulation. Even with an initial pass-through, and having all the supplementary guidance at their disposal, Weller said it took several readings for Sentinel to truly understand the ins and outs of the commitments.
Weller is bracing for organizations that are not as well versed on the complexity of the commitments to file complaints, which could add another layer of work.
"One of the things I think we are going to run into is other players in the market, ones that haven’t done that level of analysis of what Google has actually committed to, are going to make complaints. We are then going to have to spend time working out whether the complaint is valid," said Weller. "I just don’t know what that volume is going to be."
Antitrust concerns are the primary focus for all the parties involved in the arrangement, but as Weller points out, privacy plays an important part in the proceedings.
And the proceedings have started to catch the eye of plenty of other entities, as well. Weller said the European Commission's approach is new and the setup with Google could be a test case for future mergers and acquisitions. He added he's heard anecdotally of global regulators that will pay attention to whether the Commission's plan with Google turns out to be a success.
Should the arrangement be fruitful, Weller believes privacy will prove to be key, both for this acquisition and other M&As and antitrust matters going forward.
"Privacy is not an island," said Weller. "There are a lot of adjacencies and skills where you may not think of being able to look at an API and understand how it works as being a core privacy skillset. This really goes to the rise of privacy engineering as a discipline as well. If this is a successful approach and we show that they met the commitment and things go well for ten years, I would expect there would be more of this kind of things as well."
Photo by Filiberto Santillán on Unsplash
