“Googleplex,” Google headquarters, Mountain View, California. Photo credit: Shutterstock

Google has become the latest tech company under fire for exposing user data.

On Monday, the Wall Street Journal reported the Mountain View, California-based company exposed the data of thousands of users on it social network platform, Google+. Google chose not to disclose the breach when it was discovered in March because it found no evidence of data misuse.

The exposed data includes full names, photos, contact information and occupation, some of which fall under the definition of “personal data” under the European Union's General Data Protection Regulation. However, the breach occurred before the GDPR went into effect in May.

According to the WSJ, Google's in-house lawyers believed the company did not have a legal obligation to disclose the breach. Without the legal obligation to disclose, the decision whether to report takes in a number of factors.

“The lack of potential for harm certainly is a factor in a decision not to disclose,” said Albert Gidari, the consulting director of privacy at the Stanford Center for Internet and Society, in an email.

“In fact some state breach notice laws incorporate a materiality standard and don't require notice if there is little likelihood of harm. Profile data for the most part already is out there— things like email or gender and name are commonly obtainable so it is easy to see how a decision could be made not to give notice of such a breach.”

Dominique Shelton, a partner at Perkins Coie who co-chairs the firm's ad tech privacy and data management group said that if companies rush to disclose a breach without having a full picture of what data was taken and who was impacted, the disclosure could harm consumers.

If companies release inaccurate information in an effort to get a disclosure out as soon as possible, for instance, it can leave consumers confused about what data was taken and the next steps.

“The key here is to make sure you're taking steps [that are] as well meaning as possible, [and] that are also designed to be as helpful to the consumer as possible,” Shelton said.

Wiley Rein partner Kirk J. Nahra, who specializes in privacy and information security litigation, said notifying consumers of a breach that hasn't led to a misuse of personal information may create “anxiety where there is no need for anxiety.”

Consumers should be notified whenever there is a legal obligation, but outside of the law, Nahra said, the decision to disclose is “a factor of business consideration.”

“There are lots of times I've worked with companies who don't have a legal obligation to disclose and disclose anyways, and situations where they chose not to … they don't see any injury to individuals, [and there are] questions as to what the point of notice is,” he said.

Companies that chose to disclose sometimes do so as an example of customer service, or because misinformation about the breach has spread to the public. Those that chose not too sometimes think there is no point in alarming consumers over a breach with little long-term impact, or that consumers cannot change.

“It's usually do the right thing,” he said. “If you really don't think anything happened, a notice is probably just going to create unnecessary worries.”