France and Spain take action on Google
France’s DPA, the CNIL, has ordered Google to comply with France’s Data Protection Act within three months or otherwise it will impose sanctions on the company of up to up to 150,000 euros. Spain’s DPA has similarly warned Google that it could face fines between 40,000 euros to 300,000 euros for each of five violations of Spain’s DP law.
1. Define specified and explicit purposes to allow users to understand in practical terms the processing of their personal data;
2. Inform users by application of the provisions of Article 32 of France’s Data Protection Act, in particular with regard to the purposes pursued by the controller in its processing activities;
3. Define retention periods for the personal data processed that do not exceed the period necessary for the purposes for which they are collected;
4. Not proceed, without a legal basis, with the potentially unlimited combination of users’ data;
5. Fairly collect and process passive users’ data, in particular with regard to data collected using the “Doubleclick” and “Analytics” cookies, “+1” buttons or any other Google service available on the visited page;
6. Inform users and then obtain their consent, in particular, before storing cookies in their terminal.