European data protection authorities “coordinating their enforcement actions” against Google

European data protection authorities are “coordinating their enforcement actions” against Google after the company has apparently failed to take specific action on alleged “deficiencies” in its new privacy policy that came into effect one year ago.

The Article 29 Data Protection Working Party, an independent advisory group consisting of data protection authority representatives from each European Union member state, last year conducted an in depth investigation to assess the compliance of Google’s privacy policy changes with European Data Protection legislation. The Working Party, lead by France’s National Commission for Computing and Civil Liberties (CNIL), submitted two separate questionnaires to Google in March and May of last year as part of their investigations.

In a letter addressed to Larry Page, Google co-founder and current CEO, and published online in October of last year, the Working Party concluded that Google’s answers had “not demonstrated that your company [Google] endorses the key data protection principles of purpose limitation, data quality, data minimization, proportionality and right to object”.

The letter, which was signed by 27 data protection representatives from each member state, including Ireland’s Data Protection Commissioner Billy Hawkes, goes on to explain the many “grey areas” that still remain “after analyzing your [Google’s] answers to the two questionnaires”. The investigation, undertaken by individual member states but unified under the Working Party group, “unveiled several legal issues” with Google’s new privacy policy and its “combination of data”.

Last March, in Google’s effort to “create one beautifully simple, intuitive user experience across Google”, it amalgamated many product-specific privacy policies into one, and, most controversially, made it possible for the company to share users’ data between products. As an example, a user’s search history can now be used to tailor video recommendations on YouTube or follow recommendations on Google+ (should Google decide to do so).

The Working Party’s investigation found that Google provides insufficient information to its users on the purposes and the categories of data it collects. The group believes a Google user is currently unable to determine which categories of data are used for a particular Google product, and for what purpose.

The investigation also confirmed the groups “concerns about the combination of data across services” that it says allows Google “to combine almost any data from any services for any purposes”. Google collects vast amounts of personal data but has “not demonstrated that this collection was proportionate to the purposes for which they are processed”. Further to this, Google does not set “limits to the combination of data” or provide “tools allowing its users to control it”.

A third and final concern from the Working Party describes Google’s failure to “provide retention periods for the personal data it processes”. The group, in its letter, hoped that Google would take the “necessary steps to improve information and clarify the combination of data”, and “ensure compliance with data protection laws and principles”.

The Working Party listed out practical recommendations to Google regarding communication to its users on how the company processes their personal data, and also regarding the combination of data and its purposes across its products.

That was five months ago. In a press release last week, the Working Party concluded that Google has “not taken any precise measures in response to the recommendations” made by the data protection group, and that data protection regulation, specifically Directive 95/46/EC, is “still not complied with”.

The group has vowed that each data protection authority across the European Union’s member states will continue their investigations in “close cooperation”, and “take all necessary actions” afforded to them.

The Working Party has invited Google for a hearing “in the coming weeks” (probably before the end of March), and has promised that the majority of these “actions” against Google will be delivered before summer.