European data protection agencies take aim at Google over privacy

Posted Apr 3, 2013 by Robert Myles
Internet giant Google has once again come to the attention of data protection authorities across Europe as six European countries launched concerted action against Google yesterday claiming that Google had done nothing to meet privacy concerns.
Google introduced changes to its privacy policy — how it uses our personal data collected from various websites — in March last year. At the time, Google's changes met heavy criticism from European agencies charged with data protection. The Guardian reported that changes made by Google, which meant that data collected from use of YouTube, for example, could be used to ‘tailor’ a user’s experience of Gmail, came in for criticism from 30 of Europe’s data protection commissioners. The concern of European data protection authorities was that Google’s new privacy policy resulted in ‘uncontrolled’ use of personal data without an individual’s clear consent.
The latest dispute stems from Google’s perceived inaction after concerns were raised by European authorities last year. As a result, six of Europe’s leading data protection agencies launched a concerted action against Google yesterday. Led by France’s data protection agency the CNIL — the Commission nationale de l'informatique et des libertés — agencies from Germany, Spain, Italy, United Kingdom and the Netherlands will all be querying Google over privacy.
According to the CNIL website, after Google made privacy policy changes last year, European data protection authorities set up a working party to examine the new privacy policy to check whether it met the requirements of the European Data Protection Directive (95/46/CE). The Working Party published its findings on October 26, 2012 and Google was then asked to comply with the recommendations made within 4 months. CNIL claims that following expiry of the time allowed for compliance, Google had failed to take any significant compliance measures.
It will now be up to each national data protection commissioner to carry out its own investigations against Google in terms of national laws to enable implementation of the European legislation on privacy at a local level.
Google services and shared data
The problem stems from Google having made a decision to merge its privacy rules as they apply to all its services. As well as internet search functions, Google now embraces YouTube, Gmail, Google+ and is becoming the dominant player in the smartphone market through its Android operating system. CNIL’s concerns were expressed in a statement issued October 16 last when the French data regulator said, “it is not possible to ascertain from the analysis that Google respects the key data protection principles of purpose limitation, data quality, data minimization, proportionality and right to object. Indeed, the Privacy policy suggests the absence of any limit concerning the scope of the collection and the potential uses of the personal data.”
Two key statistics are a major worry for European data protection authorities, reports 20 minutes (Fr). Google is estimated to control 80% of the internet search market whilst more than 70% of smartphones sold worldwide have Google’s Android operating system. According to CNIL, Google’s new unified privacy charter therefore allows Google to tailor advertisements displayed, for example, when a user visits YouTube, depending on the user’s activity on their Android operated phone.
Google maintains its new charter is compliant with European Law. Mashable quotes a Google spokesman as saying, “Our privacy policy respects European law and allows us to create simpler, more effective services. We have engaged fully with the [data protection authorities] involved throughout this process, and we’ll continue to do so going forward."
Europe’s data protection authorities are limited in the penalties they could impose. The maximum fine is €300,000, less than a flea bite compared to Google’s estimated annual turnover of €50 billion. But the ace which the data protection authorities hold is the good reputation of a company which, since its foundation, has carefully cultivated a ‘feel-good’ image amongst internet users.