Feeds

Google in Dutch: Privacy changes BREAK data law, says Netherlands

Mountain View invited to hearing over privacy penetration and consent fail

Choosing a cloud hosting partner with confidence

Google broke data protection law in the Netherlands when the ad giant tweaked its privacy policy in March 2012, says the country's privacy watchdog.

The Dutch Data Protection Authority said on Thursday that Google had breached the country's rules because it had failed to adequately inform all its users in advance about the changes it was making to its service.

"Google spins an invisible web of our personal data, without our consent. And that is forbidden by law", said Dutch DPA chairman Jacob Kohnstamm.

The regulator said it had invited the company to a hearing. It will only decide on any enforcement action after discussions have taken place with Google.

It added:

​With its services, Google reaches almost every person in the Netherlands with internet access. It is almost impossible not to use Google services on the internet. Many internet users use the search engine Search, the video service YouTube or the webmail Gmail.

In the Report, three types of users of Google services are distinguished: people with a Google account, people without a Google account that use the open services of Google such as Search and YouTube, and people that do not use Google. Google also collects data about this last group of users, when they for example visit one of the more than 2 million websites worldwide with Google advertising cookies.

The DPA said that, during its seven-month probe, the watchdog determined that Google burrowed deeply into the personal data of Dutch netizens by knitting together services across the web for the purposes of targeted advertising.

"Some of these data are of a sensitive nature, such as payment information, location data and information on surfing behaviour across multiple websites. Data about search queries, location data and videos watched can be combined, while the different services serve entirely different purposes from the point of view of users," it said.

The watchdog concluded that Google had not sought the consent of users before cutting and shutting its privacy policies together in order to combine personal data across its massive online empire.

"The consent, required by law, for the combining of personal data from different Google services cannot be obtained by accepting general (privacy) terms of service," the Dutch DPA concluded.

In March 2012, French privacy watchdog, the Commission Nationale de l’Informatique et des Libertés (CNIL) - on behalf of the European Union's Article 29 Working Party - headed up an investigation of Google's controversial revision of its terms and conditions.

By June this year Google was ordered to comply with authorities in France within three months or face sanctions, after the CNIL ruled that the US-headquartered multibillion-dollar advertising corporation had breached the country's Data Protection Act.

It refused to comply, claiming that the law was not applicable to its online services.

Data cops in the UK, Spain, Germany and Italy have also launched enforcement actions against Google over its data land grab.

In September, Britain's Information Commissioner's Office confirmed to The Register that it had received a response from Google and added that it was "deciding whether any further action is required".

We asked the watchdog today if its investigation had progressed since then, but it said it had "no updates".

Google, meanwhile, also has yet to issue a statement about the Netherlands decision.

The company has previously said to El Reg of the CNIL-led probe that its "privacy policy respects European law". ®

Security for virtualized datacentres

More from The Register

next story
The 'fun-nification' of computer education – good idea?
Compulsory code schools, luvvies love it, but what about Maths and Physics?
Ex-US Navy fighter pilot MIT prof: Drones beat humans - I should know
'Missy' Cummings on UAVs, smartcars and dying from boredom
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
'Cowardly, venomous trolls' threatened with TWO-YEAR sentences for menacing posts
UK government: 'Taking a stand against a baying cyber-mob'
Sysadmin with EBOLA? Gartner's issued advice to debug your biz
Start hoarding cleaning supplies, analyst firm says, and assume your team will scatter
Doctor Who's Flatline: Cool monsters, yes, but utterly limp subplots
We know what the Doctor does, stop going on about it already
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.