European data protection authorities “coordinating their enforcement actions” against Google

European data protection authorities “coordinating their enforcement actions” against Google

European data protection authorities are “coordinating their enforcement actions” against Google after the company has apparently failed to take specific action on alleged “deficiencies” in its new privacy policy that came into effect one year ago.

The Article 29 Data Protection Working Party, an independent advisory group consisting of data protection authority representatives from each European Union member state, last year conducted an in depth investigation to assess the compliance of Google’s privacy policy changes with European Data Protection legislation. The Working Party, lead by France’s National Commission for Computing and Civil Liberties (CNIL), submitted two separate questionnaires to Google in March and May of last year as part of their investigations.

In a letter addressed to Larry Page, Google co-founder and current CEO, and published online in October of last year, the Working Party concluded that Google’s answers had “not demonstrated that your company [Google] endorses the key data protection principles of purpose limitation, data quality, data minimization, proportionality and right to object”.

The letter, which was signed by 27 data protection representatives from each member state, including Ireland’s Data Protection Commissioner Billy Hawkes, goes on to explain the many “grey areas” that still remain “after analyzing your [Google’s] answers to the two questionnaires”. The investigation, undertaken by individual member states but unified under the Working Party group, “unveiled several legal issues” with Google’s new privacy policy and its “combination of data”.

Last March, in Google’s effort to “create one beautifully simple, intuitive user experience across Google”, it amalgamated many product-specific privacy policies into one, and, most controversially, made it possible for the company to share users’ data between products. As an example, a user’s search history can now be used to tailor video recommendations on YouTube or follow recommendations on Google+ (should Google decide to do so).

The Working Party’s investigation found that Google provides insufficient information to its users on the purposes and the categories of data it collects. The group believes a Google user is currently unable to determine which categories of data are used for a particular Google product, and for what purpose.

The investigation also confirmed the groups “concerns about the combination of data across services” that it says allows Google “to combine almost any data from any services for any purposes”. Google collects vast amounts of personal data but has “not demonstrated that this collection was proportionate to the purposes for which they are processed”. Further to this, Google does not set “limits to the combination of data” or provide “tools allowing its users to control it”.

A third and final concern from the Working Party describes Google’s failure to “provide retention periods for the personal data it processes”. The group, in its letter, hoped that Google would take the “necessary steps to improve information and clarify the combination of data”, and “ensure compliance with data protection laws and principles”.

The Working Party listed out practical recommendations to Google regarding communication to its users on how the company processes their personal data, and also regarding the combination of data and its purposes across its products.

That was five months ago. In a press release last week, the Working Party concluded that Google has “not taken any precise measures in response to the recommendations” made by the data protection group, and that data protection regulation, specifically Directive 95/46/EC, is “still not complied with”.

The group has vowed that each data protection authority across the European Union’s member states will continue their investigations in “close cooperation”, and “take all necessary actions” afforded to them.

The Working Party has invited Google for a hearing “in the coming weeks” (probably before the end of March), and has promised that the majority of these “actions” against Google will be delivered before summer.


Darren McCarra is co-editor of The Sociable. He has a keen interest in photography, all things mobile, and writing about technology and social media. You can follow him on Twitter, Facebook and Google+.

More in Web

The Four Courts, Dublin

Chilling Effects indicates it may list ‘Right to be forgotten’ requests from EU citizens

Piers Dillon ScottJune 7, 2014
The new Google Maps – On Browser – Hello World – Google Maps

Google I/O gives us a sexy new Google Maps

Piers Dillon ScottMay 15, 2013
Big Ben, Saint Stephen's Towier in London

Why the Queen wants your IP address

Piers Dillon ScottMay 8, 2013
slow down

Google says the web is getting faster (unless you live in certain countries)

Piers Dillon ScottApril 16, 2013
Cloud storage provider Dropbox gets serious about business

Dropbox gets serious about business, introducing added security features

Darren McCarraApril 10, 2013
The Field, available to watch on RTÉ Player later this week

RTÉ Player to include movies for the first time

Darren McCarraApril 2, 2013
Page load times of the top ecommerce sites are increasing

Top ecommerce sites around the world are slowing down

Darren McCarraMarch 26, 2013
Internet Explorer on Windows 8

Is Microsoft going to piss off every web developer with the release of IE11?

Piers Dillon ScottMarch 25, 2013
Red phone boxes

Google reportedly developing a unified chat service, Babble, to rival all others

Darren McCarraMarch 19, 2013