France and Spain take action on Google

France’s DPA, the CNIL, has ordered Google to comply with France’s Data Protection Act within three months or otherwise it will impose sanctions on the company of up to up to 150,000 euros. Spain’s DPA has similarly warned Google that it could face fines between 40,000 euros to 300,000 euros for each of five violations of Spain’s DP law.

Germany, Italy, the Netherlands and the United Kingdom are all backing France and Spain and conducting their own investigations on Google. The CNIL, which is leading the joint initiative, is asking Google to revise its privacy policy to:

1. Define specified and explicit purposes to allow users to understand in practical terms the processing of their personal data;
2. Inform users by application of the provisions of Article 32 of France’s Data Protection Act, in particular with regard to the purposes pursued by the controller in its processing activities;
3. Define retention periods for the personal data processed that do not exceed the period necessary for the purposes for which they are collected;
4. Not proceed, without a legal basis, with the potentially unlimited combination of users’ data;
5. Fairly collect and process passive users’ data, in particular with regard to data collected using the “Doubleclick” and “Analytics” cookies, “+1” buttons or any other Google service available on the visited page;
6. Inform users and then obtain their consent, in particular, before storing cookies in their terminal.

The UK Information Commissioner’s Office is considering whether Google’s updated privacy policy is compliant with the UK’s Data Protection Act 1998. Also the Data Protection Commissioner of Hamburg has opened a formal procedure against Google. The Netherlands’ DPA will start the proceedings by issuing a confidential report of preliminary findings, and asking Google for comment. Italy’s DPA is waiting for more information from Google for its investigation.