updated 04:28 pm EDT, Thu July 3, 2014
Email sent to wrong address sparks privacy concerns, Google blocks access to email
A Goldman Sachs contractor sent an email containing confidential information to the wrong email account, causing the investment company to contact Google over its removal. After a Google representative told Goldman Sachs that it requires a court order to do so, the company filed a complaint with the Supreme Court of New York requesting that Google delete or retrieve the email. The company further asks for any information pertaining to its access.
The events in the case started on June 23, when the contractor was testing Goldman Sachs's internal reporting and validation process. Instead of sending it to her company email, provided by the firm, she sent it to a Gmail address. As the filing indicates, Goldman Sachs uses a "firstname.lastname@example.org" format for internal emails. Instead of using the "gs.com" domain, the contractor used "@gmail.com." Unfortunately, the contractor isn't the owner of the Gmail address, leaving the firm open to "unnecessary reputational harm" if the email cannot be deleted.
The case, which was first picked up by Reuters, forces both Goldman Sachs and Google into difficult positions over privacy. One the one hand, Goldman Sachs faces a possible leak of confidential client data to the Internet that was intended for the Financial Industry Regulator Authority. It is effectively asking Google to "unsend" the errant message in hopes of avoiding a privacy breach. On the other hand, Google treads onto the ground of violating the expectation of privacy if it simply complies with the request, which could set a dangerous legal precedent.
The number of clients affected by the erroneously- addressed email isn't specified in the court filing. Goldman Sachs attempted to contact the email account, asking that the email be deleted with a confirmation, in writing, that it was done. No reply was issued prior to the complaint being filed.
For Google's part, they confirmed that the account holder hadn't yet accessed the email. A spokeswoman for Goldman Sachs states that Google informed the company that the email account wasn't accessed since the time the email was sent on June 23. Today, Google complied with the initial request of Goldman Sachs, which was to block access to the email.
"Google complied with our request that it block access to the email," Goldman Sachs spokeswoman Andrea Raphael told Reuters. "It has also notified us that the email account had not been accessed from the time the email was sent to the time Google blocked access. No client information has been breached."
Even with the block in place, Goldman Sachs is still seeking the complete removal of the email from the account. If the relief request goes unaltered, Google may be required to provide information on who accessed the client information, as well as take "reasonable steps" to ensure the information isn't distributed or used.
The full court complaint can be read courtesy of Santa Clara University School of Law.