Out-Law News 4 min. read

EU watchdog calls for Google to postpone privacy policy updates


Google should delay the introduction of a new single privacy policy to allow the French data protection regulator to assess its impact on EU citizens, a committee of EU data protection authorities has said.

Earlier this year Google announced that it would replace the multiple privacy policies it has for the different services it operates with one single all-encompassing privacy policy covering the collection of personal data across all its services. The company has said it plans to introduce the change on 1 March.

However, privacy campaigners have expressed concern that the change could give users of Google services less control over how their information is used. The Article 29 Working Party, which is made up of the data protection watchdogs from the EU's 27 member states, has now asked Google not to introduce the policy changes until the French data protection regulator can assess what it will mean for the protection of individuals' personal information.

"Given the wide range of services you offer, and popularity of these services, changes in your privacy policy may affect many citizens in most or all of the EU member states," Jacob Kohnstamm, chairman of the Working Party, said in a letter (1-page / 23KB PDF) addressed to Google's chief executive Larry Page.

"We wish to check the possible consequences for the protection of the personal data of these citizens in a coordinated procedure. We have therefore asked the French data protection authority, the CNIL, to take the lead," said Kohnstamm. "The CNIL has kindly accepted this task and will be your point of contact for the data protection authorities in the EU. In light of the above, we call for a pause in the interests of ensuring that there can be no misunderstanding about Google's commitments to information rights of their users and EU citizens, until we have completed our analysis."

Google said that the changes would result in a simpler and easier to understand explanation of how it uses user data and enable it to offer more personalised services to those individuals.

"There are two reasons why we're updating our privacy policies: to make them simpler and more understandable, and to improve the user experience across Google," Peter Fleischer, Google's global privacy counsel, said in a letter of response to Kohnstamm.

"Most of our privacy policies have traditionally allowed us to combine information gathered in connection with one service with information from other services when users are signed into their Google Accounts. By combining information within a user's account we can improve their experience across Google ... However, our privacy policies have restricted our ability to combine information within an account for two services: Web History, which is search history for signed-in users, and YouTube, the video-sharing service we acquired in 2007," Fleischer said.

Being able to combine information across these services, as a new single privacy policy, would enable Google to offer a "simple, intuitive experience" to signed-in users across all its services "by making things easier and letting them find useful information more quickly," Fleischer said.

"Our updated privacy policy makes it clear in one comprehensive document that, if a user is signed in, we may combine information she has provided from one service with information from our other services. We'll treat that user as a single entity across all our services, which will mean a simpler, more intuitive Google experience," he said.

Fleischer suggested that Google does not intend to postpone the introduction of its new policy on 1 March.

"As you will know, we had extensively pre-briefed data protection authorities across the EU prior to the launch of our notification to users on 24 January 2012. At no stage did any EU regulator suggest that any sort of pause would be appropriate," he said. "Since we finished these extensive briefings, we have notified 350 million Google account holders, as well as providing highly visible notices to all our non-authenticated users."

"In addition, the policy does not come into effect until 1 March 2012, as we wanted to leave more than adequate time for our users to be able to read and understand the policy before it's fully implemented. We hope this overview of our updated privacy policy will help to address your concerns," he said.

Fleischer said the consolidated privacy policy did not change Google's focus on "transparency, control, and security to our users" and that users can choose not to sign-in to use Google services. He said signed-in users can also control what information is used to about them by using various privacy tools available to them, such as by deleting the history of what they have searched for or viewed on YouTube, or electing to make conversations on Gmail chat "off the record".

Google will not sell users' personal data and will not make the information "visible" to third parties, Fleischer said. He said the company will not be collecting any "new or additional" information about users than it currently does.

Nick Pickles, director of privacy and civil liberties group Big Brother Watch, told Out-Law.com that Google's planned changes present "a very clear risk" to the control users will have over their personal information.

"Consumers have different expectations of privacy when using different services, yet one uniform policy risks a catch-all consent that would allow the sharing and use of personal data across different Google services. For example, would this mean Gmail users would be served suggested YouTube videos or search advertisements based on the contents of their emails?" Pickles said.

“If Google want to have unfettered permission to use any data as they see fit, without any granular user control or permission, then it would be far better to say so and demonstrate why that would benefit consumers than engage in a masquerade of ‘simplifying’ privacy policies. We fully support the calls from the Article 29 Working Party for Google to delay implementation until there has been an opportunity for proper public scrutiny. Given the number of people affected and the very real concerns about how Google collects and uses personal information, it would be deeply unsettling if the company were to ignore these reasonable and fair concerns," he said.

We are processing your request. \n Thank you for your patience. An error occurred. This could be due to inactivity on the page - please try again.