Google Didn't Report Its Data Leak Till Months Later. Now It'll Face the Consequences.

Remember Google+?

Me neither. But while we were blissfully ignorant of its continuing existence something predictable (and quite commonplace in 2018) happened: private user data leaked.

Here's what happened. There was a bug that allowed hundreds of third party applications to access user's personal data, according to a Google blog post. We're talking user names, employers, job titles, gender, birth place and relationship status of at least half a million Google+ users, according to the Wall Street Journal.

As the Wall Street Journal points out, the bug has been around since 2015. Google says it only discovered and "immediately patched" it in March of this year — the same month Facebook's Cambridge Analytica scandal started to blow up. In the same blog post, Google announced it will shut down Google+ entirely.

So why are we only hearing about this now, seven months later? Don't Google users have a right to know if their personal data was vulnerable to hackers over the last three years? Internal memos obtained the Wall Street Journal suggest Google was trying to avoid triggering "immediate regulatory interest." In other words: avoid fines and penalties.

And there was no real reason for Google to do so. Sure, it might have had a better shot at containing the breach. But no government rules compelled the company to tell consumers right when it happened. And to do so of its own volition right when Facebook was coming under such pressure? Didn't seem like a great PR move.

In a statement to Futurism, Google points out it's already doing more than required. "Every year, we send millions of notifications to users about privacy and security bugs and issues. Whenever user data may have been affected, we go beyond our legal requirements and apply several criteria focused on our users in determining whether to provide notice."

The statement continues: "Our Privacy & Data Protection Office reviewed this issue, looking at the type of data involved, whether we could accurately identify the users to inform, whether there was any evidence of misuse, and whether there were any actions a developer or user could take in response. None of these thresholds were met in this instance."

Google claims that it found "no evidence that any developer was aware of this bug, or abusing the API," after a thorough, "root-and-branch review of third-party developer access" investigation. No one got hurt, so we're all cool, right? Right?

Is it just me, or does it feel like our personal data is being leaked on almost a weekly basis? Just two weeks ago, hackers got into 50 million Facebook accounts. One notable difference: the security issue was discovered just three days earlier by Facebook's engineering team, according to an official blog post. Guess Facebook learned something from Cambridge Analytica, after all.

Now what? Well, now the lawsuits. Ars Technica reports that California residents and Google+ users have filed the first class-action lawsuit in a federal court in San Francisco. The argument: Google knowingly made "a calculated decision not to inform users that their Personal Information was compromised," according to the complaint, as Ars Technica reported.

And Google may have to contend with the EU's General Data Protection Regulation (GDPR).  It requires companies to notify affected users of a personal data breach “without undue delay and, where, feasible, not later than 72 hours after having become aware of it,” according to Article 33 — a far shot from the seven months it took Google.

Not complying with that rule could actually hurt Google: fines of up to two percent of annual global revenue. It's been hit with these kinds of fines before, specifically one of $5 billion in May in response to reportedly violating antitrust laws on Android phones (the company has challenged the decision).

But as TechCrunch points out, Google might not have violated GDPR after all: the bug was found in March, but GDPR went into effect two months later. Since the law is still new and EU member countries are still figuring out how to enforce it, Google may find itself in a regulatory gray area.

Like all companies faced with a breach like this, Google is doing a little introspection. Google claims it's clamping down on third-party access to consumer Gmail data, and allowing users to give and revoke permissions to those third-parties — a positive step for sure.

But if you still feel wary, well, we don't blame you. Google knew about the leak for so darn long before it decided to reveal its existence. The fact that it couldn't find any evidence of misuse is little consolation.

As data breaches like these become more frequent and reveal more information, lawmakers are starting to pay attention, giving data privacy laws a much-needed second look. Consumers have a right to know if their data is ending up in hands they might not have authorized. If companies like Google are not being held accountable, they may never even learn about it.

More on data leaks: Breaking: Hackers Accessed 50 Million Facebook Accounts