EU Privacy Regulators Hit Google With Searching Questions

Robert Bond-200x200By Robert Bond, CCEP
From Compliance & Ethics Professional, a publication for SCCE members.

Over the past two years or more, the Data Protection Authorities in the EU have carried out a number of investigations into Google’s Privacy Policy with the aim of checking whether or not it meets the requirement of the EU Data Protection laws and regulations. The investigations and sanctions against Google are a reminder to all organisations that to process personal data in the EU, they must be transparent about the way in which individuals’ personal data is used and, where necessary, seek appropriate consent.

In particular, on the 15th December 2014, the Dutch Data Protection Authority published its decision to impose an incremental penalty on Google Inc. that could amount to up to €15 million if Google fails to end violations of the Dutch Data Protection Act before the end of February 2015.

The French Data Protection Authority announced in June 2013 its own decision to require Google to be more transparent regarding the way that it processes and shares personal data, particularly with regards to the data collected using Doubleclick and Google Analytics cookies.

The Information Commissioner’s Officer in the UK published news on 30th January 2015 that it had required Google to sign a formal undertaking to improve the information it provided to people about how it collects personal data in the UK following findings from the ICO that the search engine was too vague when describing how it uses personal data gathered from its web services and products. Google has now signed an undertaking committing it to make further changes to the Privacy Policy to ensure that it meets the requirements of the Data Protection Act 1998.

In making the announcement, Steve Eckersley, Head of Enforcement at the ICO said, amongst other things, “Whilst our investigation concluded that this case hasn’t resulted in substantial damage and distress to consumers, it is still important for organisations to properly understand the impact of their actions and the requirement to comply with Data Protection Law.”

The announcement from the ICO regarding the undertaking from Google also stated that, “this investigation has identified some important learning points not only for Google, but also for all organisations operating online, particularly when they seek to combine and use data across services. It is vital that there is a clear and effective information available to enable users to understand the implications of their data being combined.”

In an age where personal data is such an important asset to businesses, they must not forget that individuals have not only data privacy rights but also human rights in their information.