In a letter addressed to Larry Page, Google co-founder and current CEO, and published online in October of last year, the Working Party concluded that Google’s answers had “not demonstrated that your company [Google] endorses the key data protection principles of purpose limitation, data quality, data minimization, proportionality and right to object”.
Last March, in Google’s effort to “create one beautifully simple, intuitive user experience across Google”, it amalgamated many product-specific privacy policies into one, and, most controversially, made it possible for the company to share users’ data between products. As an example, a user’s search history can now be used to tailor video recommendations on YouTube or follow recommendations on Google+ (should Google decide to do so).
The Working Party’s investigation found that Google provides insufficient information to its users on the purposes and the categories of data it collects. The group believes a Google user is currently unable to determine which categories of data are used for a particular Google product, and for what purpose.
The investigation also confirmed the groups “concerns about the combination of data across services” that it says allows Google “to combine almost any data from any services for any purposes”. Google collects vast amounts of personal data but has “not demonstrated that this collection was proportionate to the purposes for which they are processed”. Further to this, Google does not set “limits to the combination of data” or provide “tools allowing its users to control it”.
A third and final concern from the Working Party describes Google’s failure to “provide retention periods for the personal data it processes”. The group, in its letter, hoped that Google would take the “necessary steps to improve information and clarify the combination of data”, and “ensure compliance with data protection laws and principles”.
The Working Party listed out practical recommendations to Google regarding communication to its users on how the company processes their personal data, and also regarding the combination of data and its purposes across its products.
That was five months ago. In a press release last week, the Working Party concluded that Google has “not taken any precise measures in response to the recommendations” made by the data protection group, and that data protection regulation, specifically Directive 95/46/EC, is “still not complied with”.
The group has vowed that each data protection authority across the European Union’s member states will continue their investigations in “close cooperation”, and “take all necessary actions” afforded to them.
The Working Party has invited Google for a hearing “in the coming weeks” (probably before the end of March), and has promised that the majority of these “actions” against Google will be delivered before summer.