Google fined â¬450,000 by French and Spanish data protection authorities

Google has been fined €300,000 by the Spanish data protection authority and €150,000 by the French data protection authority for breaches of national data protection laws. The Dutch data protection authority has also found Google to be in breach of Dutch data protection law.

All three cases relate to Google’s privacy policy, introduced in March 2012, which allows Google to combine personal information about its users from its different services, including the Google search engine, Gmail and YouTube. Google uses this information for a variety of purposes including displaying personalised online advertising and personalising services such as YouTube and Google’s search engine.

All three national data protection authorities have found that Google’s privacy policy of March 2012 is in breach of their respective national data protection legislation for the following reasons:

1. Google does not give users enough detail about what personal information it collects about them and for what purposes the information is processed. For example, Google does not clearly inform users of its Gmail service that the content of emails and attached files sent is filtered with the aim of serving up tailored advertising to the sender in the future.

2. The combination of personal information about users from different Google services goes beyond their reasonable expectations and makes it difficult for them to exercise control over their personal information. Google admits that users must go through a minimum of seven steps if they want to exercise all their data protection rights, including the right to opt-out of direct marketing.

3) Google keeps personal information for longer than is necessary.

Jacob Kohnstamm, the Chairman of the Dutch Data Protection Authority, has commented that “Google spins an invisible web of our personal data, without our consent… And that is forbidden by law.”

The DMA will keep members updated as to any fines which the Dutch national data protection authority may impose.

You can read about Google's row with French data protection regulator CNIL last autumn.

James Milligan, Solicitor, DMA