The French Data Protection Authorities (the CNIL) has published on its website the letter and list of questions it sent to Larry Page on 16 March 2012 concerning Google’s new privacy policy implemented on 1 March 2012 (link to CNIL site).
The questionnaire is a remarkable piece of work covering a wide range of concerns about the new privacy policy. Many of the sixty-nine questions are sub-divided and reveal a deep understanding of the differences between past and present Google privacy policies as well as the purposes to which Google puts its users’ data.
Some of the highlights of the questionnaire are as follows: It wants to know what proportion of users have actually visited the new privacy policy’s website and whether Google has put in place any mechanism to answer users’ queries about the new policy. It seeks clarification on the scope of the new policy, the services covered and the purpose of collecting sensitive personal information. It asks how long data will be held for. It asks about user consents and cookies. It probes the use of accounts across different Google services and the purpose of combining data gleaned from across those services. It probes the circumvention of browser settings (in a clear nod to the recent Safari debacle). It looks to the future by asking how Android phone users will be affected.
These questions are a fantastic start to probing what Google is up to and how it intends to use our data. They reflect many of the concerns raised by past and present Google privacy policies and combine that with some excellent investigative work into the minutiae of those policies themselves. They show how various acquisitions in the advertising space (such as DoubleClick, AdMob, AdMeld etc) have been part of a grand plan centered on the accumulation of detailed personal information.
However, although the CNIL rightly made publicly available its letter and questionnaire, it states that it will treat Google’s answers confidentially. It does not even ask for a non-confidential version. This cannot be right. Those answers are in the public interest. Lack of transparency as to its privacy practices is of great concern to many users and this is a not-to-be-missed opportunity for a debate based on clear answers to clear questions.
Even if the CNIL does not intend to make the answers publicly available, ICOMP calls on Google to do the right thing and let users know what they are signing up to (figuratively speaking). This is more than just knowing the terms and conditions of doing business with Google, it is about trust.
David Wood,
ICOMP Legal Counsel
