Then there is also the question of how much baby sitting / bureaucracy / micro management can a company like Google should/could afford.

For instance, where I work, we have mandatory training for handling ethics issues without supervision. It is pretty decent in terms of coverage and clarity. Then there is a relatively modestly staffed ethics department that can assist in resolving any issues that cannot be resolved using existing training and guidelines. There is no supervision or management involvement here. It's not management's job to burden the Engineers with supervision.

Perhaps Google could learn from this and develop a "when in ethical doubt, don't do it" culture amongst the Engineers and have a Ethics compliance department handy if issues arise that cannot be resolved using the standard training.

Obvious things aside, did the Google management actually encourage the Engineers to collect plain text data and what did Google actually do with that data - that we will never know. But what _could_ they possibly do with people's browsing data, from a management/corporation perspective? Certainly they have no use for people's passwords to increase their profits? (The "rogue employee" can do harm with that data but that is different territory.)