Berkeley students sue Google for privacy breach

Four students and alumni from the University of California-Berkeley have sued Google in federal court, alleging that the company - which runs the university's email accounts - illegally intercepted and scanned emails for advertising purposes without students' knowledge or consent.

Google's Gmail service is a core feature of Google Apps for Education, which is provided for free to thousands of US K-12 schools and universities and is used by more than 30 million students and teachers nationwide, according to the complaint.

The lawsuit alleges that Google misled Berkeley and other institutions into believing that school email accounts would not be subject to scanning for commercial purposes. The schools, in turn, assured their students and staff of their privacy.

But, the complaint alleges, Google was scanning and analysing emails to serve targeted advertisements to students until 30 April 2014, when the company announced via a blog post that it had ''permanently removed all ads scanning'' in its email service for schools, ''which means that Google cannot collect or use student data in Apps for Education services for advertising purposes''.

That announcement amounted to a tacit acknowledgement that Google had been using information from student emails to target ads, according to the plaintiffs, who allege that Google violated the Electronic Communications Privacy Act. They are asking the court to force the company to delete any information derived from the scanned emails and pay damages. Under the law, the plaintiffs could collect up to $10,000 each, or $100 for each day that the law was broken, whichever is greater.

''These schools and plaintiffs reasonably did not know, understand, or suspect that Google was secretly reading their emails for commercial purposes,'' says the complaint, filed on 27 January in the US District Court for the Northern District of California, which has jurisdiction over many cases out of Silicon Valley.

A spokeswoman for Google declined to comment.

Khaliah Barnes of the Electronic Privacy Information Center said the lawsuit highlights how little the public knows about what information Google is collecting about students through its educational apps, and how that information is being used.

''Google has not been subject to meaningful transparency, accountability and oversight concerning student records,'' Barnes said.

Chris Jay Hoofnagle, who teaches about privacy law and internet law at Berkeley, called Google's alleged scanning ''a radical attack on communications privacy''. And he's concerned about far more than advertising.

''Google could use information it gleans from the messages for its own purposes - purposes it does not have to disclose to us,'' Hoofnagle said. ''In effect, Google could act as an intelligence agency, deeply mining relationships and ideas among groups of people,'' such as new inventions students and staff at Berkeley are developing.

This is not the first time that Google - which has quickly grown into one of the nation's largest providers of technology in schools - has been accused of misusing student data for commercial gain.

The scrutiny of Google is part of a broader debate over student privacy: Advocates say that K-12 and college students don't have enough control over their own information, particularly as schools and universities turn to technology companies for everything from storing sensitive personal data to creating lessons tailored to individuals' academic needs.

The Electronic Frontier Foundation, a San Francisco-based privacy advocacy group, alleged in a December 2015 filing with the Federal Trade Commission that Google is gathering information about nearly everything that students are doing while signed into their school-based Google accounts.

The complaint also alleged that the company is sometimes using that information to serve targeted advertisements, violating the Student Privacy Pledge that it signed. FTC investigations are not public, and a spokesman for the agency said he could not confirm or deny whether it has opened a probe into those allegations.

And a previous lawsuit, in 2013, alleged that Google was illegally scanning students' emails, mirroring the Berkeley students' claims.

But the earlier case - which was filed in the same federal court - was framed differently, as a class-action suit on behalf of virtually all users of Google's Apps for Education. It ended in 2014, when a federal judge declined to certify the class, ruling that, because each school is responsible for its own privacy explanations and disclosures, users at some universities might have consented to the scanning of their emails.

Ray Gallo, the lawyer for the plaintiffs in the current lawsuit, has taken a different approach: He aims to file many near-identical claims on behalf of plaintiffs from universities where students were clearly promised that their emails would not be scanned.

He and his team used archived web pages to discern what individual schools were saying, between 2010 and 2014, about the privacy of the emails sent through university accounts. They found 11 schools that assured students in writing that their email accounts, though provided by Google, would not be scanned for advertising purposes.

Berkeley, for example, told students that data from Google core services such as email ''are not scanned for the purpose of displaying ads.'' Other schools with similarly explicit promises included Harvard, Yale, UC-Santa Cruz and San Diego State University, the complaint says.

The suit was first reported by San Diego State's student newspaper, the Daily Aztec.

Gallo said he is recruiting additional potential plaintiffs from the 11 schools and - with the help of software that allows him to automate as much of the legal process as possible - anticipates filing ''numerous'' similar lawsuits in the future.

''I joined the lawsuit to protect my privacy,'' lead plaintiff Ryan Corley, a senior at Berkeley, said in a statement provided by Gallo.

Like other students, Gallo said, Corley was required to use the account for school-related communications, and he used it to send personal information and educational records. He didn't know of the alleged scanning of his emails until he saw an advertisement that Gallo's firm placed, seeking potential plaintiffs for the case.