When Christopher Graham, the information commissioner, ordered Google to delete data including emails and passwords illegally collected from some public Wi-Fi networks, many thought the case was effectively closed.
The Metropolitan Police had ended its investigation, Google had committed to improve its data handling (PDF), and its compliance with the DPA would be audited in 2011.
But a Freedom of Information request released on Friday reveals that Google is wary of deleting all of the UK payload data, due to outstanding actions in other countries.
Update 1700: Google says it has now figured out how to do the deletion, which began today (Friday): "The vast bulk of the UK data was deleted in November, and this has been independently certified. There was some remaining data that was on the disks in the cars when we discovered our mistake.
"Because these disks could have contained data from countries where we have received preservation requests from the authorities, we had to make sure that in deleting the UK data we didn't disturb the surrounding data. We've been working hard on this and have now begun the deletion of this final remaining data."
Although the majority of UK data was deleted on 26 November, seven days after the ICO directive, some still remained on disks that "could" contain data from other countries. As Peter Fleischer, Google's global privacy counsel, explains in an email to the ICO on 26 November:
"While this deletion is now done, there is a wrinkle to the process, which I want to explain to you, for the sake of completeness. There is some data from the UK which we haven't been able to delete yet.
"This relates to data that was still on Street View car disks at the time we discovered our mistake in May. Because these disks could contain data from countries where we have received preservation requests from the authorities, we must make sure that in deleting the UK data we don't disturb the surrounding data.
"In the meantime, the data on these disks was never uploaded to our servers, and these disks have been and will remain securely stored as we work to complete the task."
Google didn't intend to publicly announce the deletion, Fleischer goes on to say, but added that he "would welcome" an announcement by the ICO.
Graham, in response, says the ICO saw "no need to give the story new legs" [meaning more publicity that would attract media attention] while the process remained incomplete.
More intriguing than that, perhaps, is Graham's sign off on his response to Google: "I am glad we secured satisfactory undertakings and I look forward to meeting [REDACTED] in Wilmslow on Tuesday. I am sure the audit process next year will [be] a positive experience for both sides." (Emphasis added.)
With eyebrows suitably raised, we leave you to flick through the emails between the two parties sent last month.
The Freedom of Information request was lodged by P. John via WhatDoTheyKnow