Google's changes to its privacy policies have been criticised by 30 European data protection commissioners for resulting in 'uncontrolled' use of personal data without individual's clear consent, relating to their use of YouTube and Gmail.
The commissioners told Google on Tuesday to give people more detailed control over personal data, and said the changes the search giant introduced in March amounted to breaking European data protection law, because the company was storing without consent cookies and data about sites people visited for between 18 months and two years.
CNIL's demand stops short of demanding a wholesale rollback of the changes introduced in March, when Google unified its privacy policies – and data – from about 60 services into a single data store.
However, the CNIL's press release is highly critical of Google, noting that it "provides insufficient information to its users on its personal data processing operations", doesn't tell people how long data will be held, and allows "uncontrolled" combination of data across its service.
The CNIL notes that for Google users, merely visiting a site which displays one of its "+1" buttons is recorded and kept for at least 18 months and can be associated with other data from other Google services. Data collected via a DoubleClick ad cookie – which is then associated with a unique identifying number – is stored by Google for two years, and can be renewed without consultation.
CNIL also criticised the company for being unco-operative in its responses to queries from the commissioners. "Google did not provide satisfactory answers on key issues such as the description of its personal data processing operations, or the precise list of the 60+ product-specific privacy policies that have been merged in the new policy," the CNIL said.
The CNIL report was applauded by privacy groups, though the US search company remained unruffled. Sources close to Google indicated that the CNIL report mostly outlined actions that the search giant "should" carry out rather than that it "must" carry out, which is being interpreted as light-touch regulation rather than full-on confrontation.
But the CNIL may be biding its time. The UK Information Commissioner's Office said that it would wait for Google's response to the report before deciding what to do next. Bradley Shears, a US lawyer who has watched the process unfold, said: "It appears that the CNIL is providing Google one last opportunity to take the appropriate actions necessary to properly address its concerns before going down the litigation route."
Marc Dautlich, a partner specialising in data protection law at Pinsent Masons in London, said: "If Google's get-out is that it's only being told 'should' rather than 'must', then it becomes a question of trust. How does a company purport to be transparent and trusted if they're put to the test and use a legal nicety to avoid it?"
There is no set timetable for a response from Google.
The CNIL wants Google to give users the chance to decide when their data is combined into services, to give better control over the combination of data. The regulators also want to centralise the change to opt out of use, decide which services their data goes into, and change its tools so that data is only used for the intended purpose – separate those used, say, for security from advertising.
The CNIL led the group of 30 data protection commissioners from across the EU, who began examining Google's proposed changes to its privacy policies in February. The company had said in January that it would alter them from the start of March, and went ahead with the changes despite requests from the CNIL to delay them, and warnings from senior European Commission officials that they could be illegal.
The CNIL has now called on Google to adhere to the EU's data protection principles. "European Data Protection legislation provides a precise framework for personal data processing operations," the CNIL said. "Google must have a legal basis to perform the combination of data of each of these purposes and data collection must also remain proportionate to the purposes pursued. However, for some of these purposes including advertising, the processing does not rely on consent, on Google's legitimate interests, nor on the performance of a contract."
Pickles added: "It's absolutely right that European regulators focus on ensuring people know what data is being collected and how it is being used. Unless people are aware just how much of their behaviour is being monitored and recorded it is impossible to make an informed choice about using services. This ruling is an important step to putting consumers in control of their personal information and ensuring that companies like Google are not able to easily disregard people's privacy in pursuit of more information and greater profits."
Jim Killock, executive director of the Open Rights Group, said: "It's good to see European data protection authorities take action so that users gain control of their data. This must be backed by strong new data protection powers, for fines based on turnover, and rights to retrieve and to delete your data."
The UK's Information Commissioner's Office (ICO) said: "We await Google's response which will be considered by the CNIL, on behalf of the ICO and the other European data protection regulators. A decision will then be made on whether further action is required."
guardian.co.uk © Guardian News and Media Limited 2010