European data protection authorities and Google are on a collision course over the planned introduction of Google’s new privacy policies on 1 March.
Writing on behalf of the all the other EU data protection authorities (united under the banner of the so-called Article 29 Working Party), the President of the French Data Protection Authority (the Commission Nationale de l’lnformatique et des Libertes or CNIL) has written to Google reiterating previous formal demands for Google not to implement the new policies until a full review of their legality has taken place.
The letter sets out both the results of a preliminary review as well as a very tight timetable for further investigation. In particular, the President of the CNIL has stated that: The CNIL and the EU data protection authorities are deeply concerned about the combination of personal data across services: they have strong doubts about the lawfulness and fairness of such processing, and about its compliance with European Data Protection legislation. The letter also describes a number of ways in which the new policies are considered to be lacking in transparency, unclear and unfair to users.
By any measure, this looks to be an extremely aggressive move by Google. It seems determined to use its monopoly power to impose new data protection rules on users which it knows are unfair, lacking in transparency and apparently unlawful. Moreoever, It has obviously irritated the data protection authorities by making claims about previous contacts which appear to have been untrue (just as it claimed to the Leveson Inquiry that its policies had been “applauded” by the European Commission despite categoric statements by Commissioner Reding that her services had not yet had time to study them). Finally, the call to suspend implementation has been reiterated by the authorities in the strongest possible terms.
This is a major opportunity for users, regulators, politicians and other stakeholders to voice their concerns about Google’s behaviour. Over the next few days we will see whether Google will seek to brazen it out and ride roughshod over the authorities which are charged with ensuring the protection of Europe’s consumers and respect for European law. The implications are enormous and extend far more broadly than privacy.
ICOMP Legal Counsel