Feeds

Google in Dutch: Privacy changes BREAK data law, says Netherlands

Mountain View invited to hearing over privacy penetration and consent fail

Boost IT visibility and business value

Google broke data protection law in the Netherlands when the ad giant tweaked its privacy policy in March 2012, says the country's privacy watchdog.

The Dutch Data Protection Authority said on Thursday that Google had breached the country's rules because it had failed to adequately inform all its users in advance about the changes it was making to its service.

"Google spins an invisible web of our personal data, without our consent. And that is forbidden by law", said Dutch DPA chairman Jacob Kohnstamm.

The regulator said it had invited the company to a hearing. It will only decide on any enforcement action after discussions have taken place with Google.

It added:

​With its services, Google reaches almost every person in the Netherlands with internet access. It is almost impossible not to use Google services on the internet. Many internet users use the search engine Search, the video service YouTube or the webmail Gmail.

In the Report, three types of users of Google services are distinguished: people with a Google account, people without a Google account that use the open services of Google such as Search and YouTube, and people that do not use Google. Google also collects data about this last group of users, when they for example visit one of the more than 2 million websites worldwide with Google advertising cookies.

The DPA said that, during its seven-month probe, the watchdog determined that Google burrowed deeply into the personal data of Dutch netizens by knitting together services across the web for the purposes of targeted advertising.

"Some of these data are of a sensitive nature, such as payment information, location data and information on surfing behaviour across multiple websites. Data about search queries, location data and videos watched can be combined, while the different services serve entirely different purposes from the point of view of users," it said.

The watchdog concluded that Google had not sought the consent of users before cutting and shutting its privacy policies together in order to combine personal data across its massive online empire.

"The consent, required by law, for the combining of personal data from different Google services cannot be obtained by accepting general (privacy) terms of service," the Dutch DPA concluded.

In March 2012, French privacy watchdog, the Commission Nationale de l’Informatique et des Libertés (CNIL) - on behalf of the European Union's Article 29 Working Party - headed up an investigation of Google's controversial revision of its terms and conditions.

By June this year Google was ordered to comply with authorities in France within three months or face sanctions, after the CNIL ruled that the US-headquartered multibillion-dollar advertising corporation had breached the country's Data Protection Act.

It refused to comply, claiming that the law was not applicable to its online services.

Data cops in the UK, Spain, Germany and Italy have also launched enforcement actions against Google over its data land grab.

In September, Britain's Information Commissioner's Office confirmed to The Register that it had received a response from Google and added that it was "deciding whether any further action is required".

We asked the watchdog today if its investigation had progressed since then, but it said it had "no updates".

Google, meanwhile, also has yet to issue a statement about the Netherlands decision.

The company has previously said to El Reg of the CNIL-led probe that its "privacy policy respects European law". ®

Boost IT visibility and business value

More from The Register

next story
'Stop dissing Google or quit': OK, I quit, says Code Club co-founder
And now a message from our sponsors: 'STFU or else'
Ex US cybersecurity czar guilty in child sex abuse website case
Health and Human Services IT security chief headed online to share vile images
Don't even THINK about copyright violation, says Indian state
Pre-emptive arrest for pirates in Karnataka
The police are WRONG: Watching YouTube videos is NOT illegal
And our man Corfield is pretty bloody cross about it
Felony charges? Harsh! Alleged Anon hackers plead guilty to misdemeanours
US judge questions harsh sentence sought by prosecutors
Oz biz regulator discovers shared servers in EPIC FACEPALM
'Not aware' that one IP can hold more than one Website
Apple tried to get a ban on Galaxy, judge said: NO, NO, NO
Judge Koh refuses Samsung ban for the third time
prev story

Whitepapers

Best practices for enterprise data
Discussing how technology providers have innovated in order to solve new challenges, creating a new framework for enterprise data.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?