Feeds

France gives Google three month DATA PRIVACY DEADLINE

Liberté, egalité, intimité

Build a business case: developing custom apps

Data authorities have ruled that Google has breached the French Data Protection Act, and the huge advertising firm has been ordered to comply with the law within three months or else face sanctions.

Data watchdogs in the UK, Spain, Germany, Italy, and the Netherlands have also launched enforcement actions against Google today, France's Commission Nationale de l’Informatique et des Libertés (CNIL) said.

The French regulator was tasked by Brussels' Article 29 Working Party with investigating Google's controversial privacy policy changes in March 2012. In April this year it found that the ad giant had not implemented any "significant compliance measures."

In the UK, the Information Commissioner's Office is looking at whether Google's rejigged privacy policy is compliant with the Data Protection Act 1998.

The Brit watchdog will be firing off a letter to the company soon, the CNIL said. The ICO, which is led by Commissioner Christopher Graham - who is vice chair of the Article 29 Working Party - did not immediately respond to The Register's request for comment at time of writing.

Google was told in a formal notice from the CNIL that it has until September to implement the following changes to its service:

  • Define specified and explicit purposes to allow users to understand practically the processing of their personal data;
  • Inform users by application of the provisions of Article 32 of the French Data Protection Act, in particular with regard to the purposes pursued by the controller of the processing implemented;
  • Define retention periods for the personal data processed that do not exceed the period necessary for the purposes for which they are collected;
  • Not proceed, without legal basis, with the potentially unlimited combination of users’ data;
  • Fairly collect and process passive users’ data, in particular with regard to data collected using the 'Doubleclick' and 'Analytics' cookies, '+1' buttons or any other Google service available on the visited page;
  • Inform users and then obtain their consent in particular before storing cookies in their terminal.

Data protection authorities in some of the other countries mentioned by the CNIL are way ahead of the ICO.

In Spain, the DPA has opened a sanction procedure against Google for the infringement of key principles of the Spanish Data Protection law.

While Hamburg's Commissioner in Germany will shortly hold a formal hearing that may lead to the release of an administrative order demanding that Google implements measures which comply with the country's DP legislation.

The Dutch data protection regulator is set to issue a confidential report of a preliminary investigation and will ask Google to respond to its findings. Depending on the outcome of those discussions, the DPA could then issue sanctions.

The Italian data watchdog, meanwhile, is seeking clarification from Google after it opened a formal inquiry proceeding last month. It will shortly be looking at the findings of its probe, which could lead to possible enforcement measures that may include sanctions under the country's data protection law, the CNIL said.

Google, however, failed to see what all the fuss was about.

“Our privacy policy respects European law and allows us to create simpler, more effective services. We have engaged fully with the authorities involved throughout this process, and we’ll continue to do so going forward," the company told the Register. ®

Build a business case: developing custom apps

More from The Register

next story
'Stop dissing Google or quit': OK, I quit, says Code Club co-founder
And now a message from our sponsors: 'STFU or else'
Top beak: UK privacy law may be reconsidered because of social media
Rise of Twitter etc creates 'enormous challenges'
Uber, Lyft and cutting corners: The true face of the Sharing Economy
Casual labour and tired ideas = not really web-tastic
Ex US cybersecurity czar guilty in child sex abuse website case
Health and Human Services IT security chief headed online to share vile images
Don't even THINK about copyright violation, says Indian state
Pre-emptive arrest for pirates in Karnataka
The police are WRONG: Watching YouTube videos is NOT illegal
And our man Corfield is pretty bloody cross about it
Oz biz regulator discovers shared servers in EPIC FACEPALM
'Not aware' that one IP can hold more than one Website
prev story

Whitepapers

Gartner critical capabilities for enterprise endpoint backup
Learn why inSync received the highest overall rating from Druva and is the top choice for the mobile workforce.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.