French Agency Says Google’s New Privacy Policy may be Illegal

PARIS – The French agency tasked with protecting online data says Google’s new privacy policy may be a violation of European Union Law. Google’s announced intention to track the activities of users across almost all of its holdings will take effect on March 1.

The National Commission for Computing and Civil Liberties, the French privacy agency, wrote to Larry Page, Google’s co-founder and chief executive, that the proposed policy was unclear in the details of how the company would use private data.

“Rather than promoting transparency, the terms of the new policy and the fact that Google claims publicly that it will combine data across services raises fears about Google’s actual practices,” the letter from the French privacy agency, known as CNIL, said. “Our preliminary investigation shows that it is extremely difficult to know exactly which data is combined between which services for which purposes, even for trained privacy professionals.”

Google has been quietly collecting most of this information for quite a while. But now, for the first time, it is combining data from across its varied sites to create a unified portrait of its users. The changes take place on March 1st and users will not be able to decline the tracking.

Consumer advocates in the United State and Europe have been sounding alarms for some time over the announced changes. Common Sense Media chief executive, James Steyer noted, “Google’s new privacy announcement is frustrating and a little frightening. Even if the company believes that tracking users across all platforms improves their services, consumers should still have the option to opt out—especially the kids and teens who are avid users of YouTube, Gmail and Google Search.”

A number of lawmakers and consumer advocates remain skeptical of Google’s intentions. “There is no way anyone expected this,” said Jeffrey Chester, executive director of the Center for Digital Democracy. “There is no way a user can comprehend the implication of Google collecting across platforms for information about your health, political opinions, and financial concerns.”

France’s warning to Google carries possible implications for other European Union countries. The French regulator was acting at the request of an advisory panel to the European Commission, which asked the French agency to conduct an initial assessment of the Google privacy changes.

The French commission is already in the process of overhauling its privacy rules to bring them in line with the era of the Internet and cloud computing. The commissioner in charge of privacy, Viviane Reding, has called for streamlined privacy rules, which currently vary widely across the European Union, with separate enforcement bodies like the French privacy agency overseeing national guidelines.

Google is also facing an antitrust investigation in Brussels, where the European Commission is examining its dominant position in Internet search. The privacy policies of individual Google services, especially its StreetView mapping feature, have also been investigated in a number of European Union countries.

Peter Fleischer, Google’s chief privacy counsel, defended the March1st change. “We are confident that our new simple, clear, and transparent privacy policy respects all European data protection laws and principles,” he wrote in a letter to the French privacy agency. He said the company had attempted unsuccessfully to meet with the agency to discuss the changes.

“Like all companies, we have struggled with the conundrum of how to pursue both of the CNIL’s recommendations: How to ‘streamline and simplify’ our privacy policies, while at the same time providing ‘comprehensive information’ to our users,” Mr. Fleischer’s letter states.

The French privacy agency can fine companies up to 300,000 euros ($400,000) for privacy breaches in France. It can also seek court orders to try to stop companies from engaging in practices that are deemed to violate data protection laws. Enforcement in other European countries would be up to individual data protection authorities.

Big Brother Watch, a British privacy advocate, published a study on Tuesday that said only twelv percent of Google users had read the new policy. Forty-seven percent were unaware of the changes, the study showed.

“Google is putting advertisers’ interests before user privacy and should not be rushing ahead before the public understands what the changes will mean,” the group said in a statement posted on its Web site.