EU launches legal action against Google over privacy policy

Google faces legal action from six European national data protection authorities (DPAs) over its failure to change its privacy policy. The threat comes as a four-month deadline to change Google’s privacy policy expires. On 2 April 2013, the DPAs of France, Germany, Italy, Holland, Spain and UK announced that they have started enforcement actions.

This follows an investigation between March and October 2012 into whether Google’s privacy policy complied with the 1995 European Data Protection Directive, which the six DPAs carried out on behalf of the Article 29 Working Party (made up of the heads of the national data protection authorities in EU Member States), under the leadership of the French DPA (CNIL). At a meeting between Google and the six DPAs on 19 March, Google decided not to implement the recommendations of the Working Party because it believes that the privacy policy is compliant with EU data protection law.

The trouble with Google’s privacy policy
Google’s privacy policy is too general to comply with the Directive, according to the Working Party. The Working Party’s October 2012 report found that Google’s privacy policy did not comply with the Directive’s requirement to precisely inform the user of the type of data collected, its purposes and who will receive this data.

Google’s privacy policy covers almost every Google product and service and allows the search engine giant to combine all data collected in a single user profile. So, for example, if a user searches for classical music in Google search, Google can use the information to suggest classical music videos on YouTube.

Article 29 Working Party recommendations to Google
Google should give users clearer information and more control over the combination of personal information across Google’s services. This is particularly relevant with the arrival of new services such as Google Now, which recognises a user’s repeated actions on a device (email appointments and social networking activity) to display more relevant information. Another service on the horizon, Google Glasses, raises yet more concerns. These smart glasses overlay data in front of people’s eyes using a built-in camera, display, touchpad, battery and microphone. The first versions of the Glasses are currently in the hands of developers.

The shape of things to come under new EU data laws?
The way the various national DPAs have cooperated over this issue provides clues as to how they will work together under the draft Data Protection Regulation currently going through the European Union legislative process.

There are proposals in the draft Regulation, such as the one-stop-shop proposal, which will require one national DPA to take the lead and to cooperate with other relevant DPAs. The lead national DPA will be the country where an organisation’s (in this case Google’s) data management function is located.

National DPAs in other member states who receive data protection complaints about the organisation’s activities will refer the complaints to the lead DPA. This means that the organisation will, in theory, only have to deal with one DPA rather than possibly up to 27, as it does now.

James Milligan, Solicitor, Direct Marketing Association