Googles new privacy policy raises deep concerns about data protection and the respect of...

Page 1 of 2

Home > News and events > News > Googles new privacy policy raises deep concerns about data protection and the respect of the European law

Pour approfondir
Lettrer addressed to Google on the 2702...

News
Googles new privacy policy raises deep concerns about data protection and the respect of the European law
28 February 2012 The Article 29 Working Party invited the CNIL to take the lead in the analysis of Googles new privacy policy. Preliminary findings show that Googles new policy fails to meet the requirements of the European Data Protection Directive (95/46/CE) regarding the information that must be provided to data subjects. Moreover,the CNIL and the EU data protection authorities are deeply concerned about the combination of data across services and will continue their investigations with Googles representatives. The CNIL reiterated its request to Google to postpone the application of the new policy,on behalf of the Article 29 Working Party. The Article 29 Working Party invited the CNIL to take the lead in the analysis of Googles new privacy policy. Preliminary findings show that Googles new policy fails to meet the requirements of the European Data Protection Directive (95/46/CE) regarding the information that must be provided to data subjects. Moreover, the CNIL and the EU data protection authorities are deeply concerned about the combination of data across services and will continue their investigations with Googles representatives. The CNIL reiterated its request to Google to postpone the application of the new policy, on behalf of the Article 29 Working Party. By letter of 2 February 2012, the Article 29 Working Party invited the CNIL to take the lead in the analysis of the announcement by Google of a new privacy policy that will be effective on 1 March 2012. The CNIL and the EU data protection authorities regret that Google did not accept to delay the application of this new policy which raises legitimate concerns about the protection of the personal data of European citizens. While the CNIL and the EU data protection authorities welcome Googles initiative to streamline and simplify its privacy policies, they firmly believe that this effort should not be conducted at the expense of transparency and comprehensiveness. By merging the privacy policies of its services, Google makes it impossible to understand which purposes, personal data, recipients or access rights are relevant to the use of a specific service. As such, Googles new policy fails to meet the requirements of the European Data Protection Directive (95/46/CE) regarding the information that must be provided to data subjects. Google should supplement existing information with processing- and purpose-specific information. Moreover, rather than promoting transparency, the terms of the new policy and the fact that Google claims it will combine data across services raise fears and questions about Googles actual practices. Under the new policy, users understand that Google will be able to track and combine a large part of their online activities thanks to products such as Android, Analytics or its advertising services. For instance, the new policy would allow Google to display on Youtube ads that are related to the users activity on its Android phone (personal number, calling party numbers, date and time of calls) and to its location data. The impact on privacy and

http://www.cnil.fr/english/news-and-events/news/article/googles-new-privacy-policy-raise... 2/29/2012

Googles new privacy policy raises deep concerns about data protection and the respect of... Page 2 of 2

data protection is all the more important, given that Google represents more than 80% of the European search engine market, around 30% of the European smartphones market, 40% of the global online video market and more than 40% of the global online advertisement market; Google Analytics is also the most popular analytics tool in Europe. In addition, the use of cookies (among other tools) for these combinations raises issues related to Googles compliance to the principle of consent laid down in the revised ePrivacy Directive (2002/58/CE). The CNIL and the EU data protection authorities are deeply concerned about the combination of data across services and have strong doubts about the lawfulness and fairness of such processing. They intend to address these questions in detail with Googles representatives. As a preliminary step, the CNIL has sent a letter to Google exposing these concerns. Considering the preliminary findings of the investigation, the CNIL reiterated the request to Google to postpone the application of the new policy, on behalf of the Article 29 Working Party. Retour

http://www.cnil.fr/english/news-and-events/news/article/googles-new-privacy-policy-raise... 2/29/2012