Google privacy policy slammed by EU data protection chiefs

Google's changes to its privacy policies have been criticised by 30 European data protection commissioners for resulting in 'uncontrolled' use of personal data without individual's clear consent, relating to their use of YouTube and Gmail.

The commissioners told Google on Tuesday to give people more detailed control over personal data, and said the changes the search giant introduced in March amounted to breaking European data protection law, because the company was storing without consent cookies and data about sites people visited for between 18 months and two years.

The French data protection commissioner, the CNIL, led the inquiry and said that Google in effect let users pick and choose how their data was used among different services such as Gmail, Youtube and Google+ – a dramatic rewrite of the single privacy policy Google introduced in March.

CNIL's demand stops short of demanding a wholesale rollback of the changes introduced in March, when Google unified its privacy policies – and data – from about 60 services into a single data store.

Google said it would consider its next steps, but said it had not broken the law. Peter Fleischer, Google's global privacy counsel said in a statement: "We have received the report and are reviewing it now. Our new privacy policy demonstrates our long-standing commitment to protecting our users' information and creating great products. We are confident that our privacy notices respect European law."

Google's latest privacy policy means that users get a simpler experience when signing up for a new Google-owned service. But it also means that Google can build up a more comprehensive picture of the user for advertising – for example, monitoring a person's use of YouTube to help better target adverts within Gmail.

However, the CNIL's press release is highly critical of Google, noting that it "provides insufficient information to its users on its personal data processing operations", doesn't tell people how long data will be held, and allows "uncontrolled" combination of data across its service.

The CNIL notes that for Google users, merely visiting a site which displays one of its "+1" buttons is recorded and kept for at least 18 months and can be associated with other data from other Google services. Data collected via a DoubleClick ad cookie – which is then associated with a unique identifying number – is stored by Google for two years, and can be renewed without consultation.

CNIL also criticised the company for being unco-operative in its responses to queries from the commissioners. "Google did not provide satisfactory answers on key issues such as the description of its personal data processing operations, or the precise list of the 60+ product-specific privacy policies that have been merged in the new policy," the CNIL said.

The CNIL report was applauded by privacy groups, though the US search company remained unruffled. Sources close to Google indicated that the CNIL report mostly outlined actions that the search giant "should" carry out rather than that it "must" carry out, which is being interpreted as light-touch regulation rather than full-on confrontation.

But the CNIL may be biding its time. The UK Information Commissioner's Office said that it would wait for Google's response to the report before deciding what to do next. Bradley Shears, a US lawyer who has watched the process unfold, said: "It appears that the CNIL is providing Google one last opportunity to take the appropriate actions necessary to properly address its concerns before going down the litigation route."

Marc Dautlich, a partner specialising in data protection law at Pinsent Masons in London, said: "If Google's get-out is that it's only being told 'should' rather than 'must', then it becomes a question of trust. How does a company purport to be transparent and trusted if they're put to the test and use a legal nicety to avoid it?"

There is no set timetable for a response from Google.

The CNIL wants Google to give users the chance to decide when their data is combined into services, to give better control over the combination of data. The regulators also want to centralise the change to opt out of use, decide which services their data goes into, and change its tools so that data is only used for the intended purpose – separate those used, say, for security from advertising.

The CNIL led the group of 30 data protection commissioners from across the EU, who began examining Google's proposed changes to its privacy policies in February. The company had said in January that it would alter them from the start of March, and went ahead with the changes despite requests from the CNIL to delay them, and warnings from senior European Commission officials that they could be illegal.

The CNIL has now called on Google to adhere to the EU's data protection principles. "European Data Protection legislation provides a precise framework for personal data processing operations," the CNIL said. "Google must have a legal basis to perform the combination of data of each of these purposes and data collection must also remain proportionate to the purposes pursued. However, for some of these purposes including advertising, the processing does not rely on consent, on Google's legitimate interests, nor on the performance of a contract."

Nick Pickles, director of privacy campaign group Big Brother Watch, said: "Consumers have been kept in the dark about how much data Google collects and what happens to that data, and Google's new privacy policy only further disguised what really happens when you use their services.

Pickles added: "It's absolutely right that European regulators focus on ensuring people know what data is being collected and how it is being used. Unless people are aware just how much of their behaviour is being monitored and recorded it is impossible to make an informed choice about using services. This ruling is an important step to putting consumers in control of their personal information and ensuring that companies like Google are not able to easily disregard people's privacy in pursuit of more information and greater profits."

Jim Killock, executive director of the Open Rights Group, said: "It's good to see European data protection authorities take action so that users gain control of their data. This must be backed by strong new data protection powers, for fines based on turnover, and rights to retrieve and to delete your data."

The UK's Information Commissioner's Office (ICO) said: "We await Google's response which will be considered by the CNIL, on behalf of the ICO and the other European data protection regulators. A decision will then be made on whether further action is required."