French Regulator: Google’s New Privacy Policy Violates EU Standards

Google's privacy policy will be updated March 1.

BRUSSELS (The Blaze/AP) — Google‘s new privacy policy appears to violate the European Union’s data protection rules, France’s regulator said Tuesday, just two days before the new guidelines are set to come into force.

Google announced its new privacy policy with much fanfare last month. The rules, which are set to come into force on Thursday, regulate how the Web giant uses the enormous amounts of personal data its collects through its search engine, email and other services.

(Related: Why you might want to delete your Google browser history before next week)

However, the EU’s data protection authorities are concerned about the privacy effects of the policy and earlier this month asked French regulator CNIL to investigate them.

“Our preliminary analysis shows that Google’s new policy does not meet the requirements of the European Directive on Data Protection,” CNIL said in a letter to Google Chief Executive Larry Page. The letter was sent Monday and posted on CNIL’s website Tuesday.

CNIL wrote that it “regrets” Google did not agree to postpone implementation of its new policy as it has ”[raised] legitimate concerns about the protection of the personal data of European citizens.” CNIL reiterates its request to delay implementation of the changes.

The agency also said Google’s explanation of how it will use the data was too vague and difficult to understand “even for trained privacy professionals”. Here’s more from the letter:

Moreover, rather than promoting transparency, the terms of the new policy and the fact that Google claims it will combine data across services raise fears and questions about Google’s actual practices. Under the new policy, users understand that G

[...]

The impact on privacy and data protection is all the more important, given that Google represents more than 80% of the European search engine market, around 30% of the European smartphones market, 40% of the global online video market and more than 40% of the global online advertisement market; Google Analytics is also the most popular analytics tool in Europe. In addition, the use of cookies (among other tools) for these combinations raises issues related to Google’s compliance to the principle of consent laid down in the revised ePrivacy Directive (2002/58/CE).

The new policy makes it easier for Google to combine the data of one person using different services such as the search engine, YouTube or Gmail if he is logged into his Google account. That allows Google to create a broader profile of that user and target advertising based on that person’s interests and search history more accurately. Advertising is the main way Google makes its money.

Google argues that combining the data into one profile also makes search results more relevant and allows a user to cross-navigate between different services more easily.

“Over the past month we have asked to meet with the CNIL on several occasions to answer any questions they might have, and that offer remains open,” said Peter Fleischer, Google’s global privacy counsel. “We are committed to providing our users with a seamless experience across Google’s services, and to making our privacy commitments to them easy to understand.”

The probe of the privacy policy is one of several battle lines between Google and the European Commission, the executive arms of the 27-country EU.

Google’s search engine has a market share of more than 90 percent in the EU, with rival services like Microsoft’s Bing gaining little traction.

The Commission is already examining whether Google uses this dominance to stop other search engines from entering the market. It is also investigating complaints from Microsoft and Apple into whether Motorola, which Google is in the process of taking over, is breaking EU competition rules in its aggressive enforcement of standard-essential patents.