•

Google's privacy policy changes breach European law, France is arguing

France asks European data authorities to investigate pooling of user data by search engine giant, which kicked in on Thursday 1 March

• Google’s new ‘tailored’ privacy policy: how to circumvent the rules

France is leading the charge against Google’s new privacy rules, which come into force today (Thursday 1 March), arguing the sweeping changes breach European law.

France’s data protection watchdog, the CNIL, told Google in a letter dated 27 February that it would lead a Europe-wide investigation of the policy, which involves Google pooling the data on individual users gathered via any of its sites – search, YouTube, Gmail, Google+ and others – allowing it to tailor search results, target users with advertising and make other uses of the information.

Google said in January it was simplifying its privacy rules, consolidating 60 policies into a single one, and has promoted it as a positive change.

Users cannot opt out of the new policy if they want to continue using Google’s services.

“The CNIL and EU data authorities are deeply concerned about the combination of personal data across services: they have strong doubts about the lawfulness and fairness of such processing and its compliance with European data protection legislation,” the French regulator wrote to Google.

Google has put the changes into effect from Thursday 1 March and has rebuffed two requests from European regulators for a delay.

The tussle over data privacy comes at a delicate time for Google, whose business model has become to give away free search, email and other services while making money by selling user-targeted advertising.

It is already being investigated by the EU’s competition authority and the US Federal Trade Commission over how it ranks search results and whether it favours its own products over those of rivals.

In a blogpost responding to CNIL’s letter, Google said it was happy to answer questions from Europe’s data protection authorities. “As we’ve said several times over the past week, while our privacy policies will change on 1st March, our commitment to our privacy principles is as strong as ever,” wrote Peter Fleischer, Google’s global privacy counsel.

In his letter to CNIL, Fleischer added: “We are confident that our new simple, clear and transparent privacy policy respects all European data protection laws and principles.”

Google’s new privacy policy follows closely on a European commission move to overhaul its 17-year-old data protection rules in favour of more stringent requirements. Under the proposed new EU rules, companies like Google, Facebook and Yahoo would have to ask users for permission to store and sell their data to other businesses, such as advertisers, which is the source of almost all their income.

Internet users could also ask for their data to be deleted from websites for good, the so-called “right to be forgotten”.

Policymakers in other countries have also expressed concerns over Google’s new privacy policy. Eight US lawmakers sent a letter to Google in late January saying a planned consolidation of user information endangered consumers’ privacy.

Japan’s trade and industrial ministry warned on Wednesday that Google must follow Japan’s privacy law in implementing its new approach, and that Google needed to provide explanations to address users’ concerns. “It is important for the firm to be flexible by providing necessary additional explanations or measures to address actual user concerns or requests also after March 1…” the ministry said in a statement.

Google has pointed out that users can search anonymously or while logged out to avoid being tracked, as well as using separate accounts on different Google services to keep data diffused – although critics argue this makes for a clunky user experience. Users can also control their advertising preferences and make sure their web history is not tracked.

“Google’s new privacy policy states that, as was the case before: when showing you tailored ads, we will not associate a cookie or anonymous identifier with sensitive categories, such as those based on race, religion, sexual orientation or health,” a spokesman said.

In a guest post to the Guardian, Alma Whitten, the company’s director of privacy explains its thinking behind the unification of its privacy policies and accompanying data.

“Our approach to privacy isn’t changing. We’re not collecting any new information as a result of this change. We’re not altering any of your privacy settings. And we still won’t sell your personal information to advertisers. We just want to use the information you already trust us with to make your experience better,” she writes.

France asks European data authorities to investigate pooling of user data by search engine giant, which kicked in on Thursday 1 March • Google’s new ‘tailored’ privacy policy: how to circumvent the rules France is leading the charge...