Google given 35 days to delete wi-fi data

Google has been given 35 days to delete any remaining data it "mistakenly collected" while taking pictures for its Street View service, or face criminal proceedings.

But the UK Information Commissioner's Office did not impose a fine.

Its investigation into Google reopened last year after further revelations about the data taken from wi-fi networks.

During that inquiry, additional discs containing private data were found.

Google had previously pledged to destroy all data it had collected, but admitted last year that it had "accidentally" retained the additional discs.

The ICO has told the search giant it must inform it if any further discs of information are discovered.

"Today's enforcement notice strengthens the action already taken by our office, placing a legal requirement on Google to delete the remaining payload data identified last year within the next 35 days and immediately inform the ICO if any further discs are found," said Stephen Eckersley, the office's head of enforcement.

Google Street View, which launched in 2007, has been one of the search company's most ambitious projects to date.

Using specially-adapted cars, it created panoramic images of more than five million miles of the world's roads.

But it was during that process, in 2010, when one unnamed Google engineer wrote a piece of software that would pull data from the unsecured wi-fi networks the car encountered as it drove through towns and cities.

The data included personal emails and other sensitive information.

Google has said it did not plan to collect this data, and that the engineer was acting independently. However, it later transpired that at least one senior manager at the company was aware the collection was taking place.

To date, various regulators around the world have for the most part agreed with this assertion, concluding that the "mistakenly" gathered data was a result of sloppy management at a low level, rather than misguided direction from the top.

"Failure to abide by the notice will be considered as contempt of court, which is a criminal offence."

However, unlike authorities in the US, the ICO said it would not be issuing a fine.

"The detriment caused to individuals by this breach fails to meet the level required to issue a monetary penalty," it said.

It concluded that the collection of the data in 2010 was due to "procedural failings and a serious lack of management oversight", but agreed with Google's assertion that the company did not order the actions at a corporate level.

In a statement on Friday, Google said: "We work hard to get privacy right at Google.

"But in this case we didn't, which is why we quickly tightened up our systems to address the issue. The project leaders never wanted this data, and didn't use it or even look at it.

"We co-operated fully with the ICO throughout its investigation, and having received its order this morning we are proceeding with our plan to delete the data."