http://www.nytimes.com/2012/02/29/technology/france-says-google-privacy-plan-likely-violates-european-law.html

February 28, 2012

France Says Google Privacy Plan Likely Violates European Law

By ERIC PFANNER

PARIS -- The French data protection authority said on Tuesday that Google's new privacy policy appeared to violate European Union law.

Google announced the new policy last month, billing it as a way to streamline and simplify the privacy practices it employed worldwide across about 60 different online services, and to introduce greater clarity for users.

But the French privacy agency, the National Commission for Computing and Civil Liberties, said in a letter [1] to Larry Page, Google's co-founder and chief executive, that the proposed policy was murky in the details of how the company would use private data. Google and other Internet companies gather personal information in an effort to build anonymous profiles of users, helping them to sell advertising.

"Rather than promoting transparency, the terms of the new policy and the fact that Google claims publicly that it will combine data across services raises fears about Google's actual practices," the letter from the French privacy agency, known as CNIL, said. "Our preliminary investigation shows that it is extremely difficult to know exactly which data is combined between which services for which purposes, even for trained privacy professionals."

The warning to Google carries potential implications for other European Union countries, because in this case the French regulator was acting at the request of an advisory panel to the European Commission, which asked the French agency to conduct an initial assessment of the Google privacy changes. The new rules were set to come into effect on Thursday.

Meanwhile, the commission is in the process of overhauling its privacy rules to bring them in line with the era of the Internet and cloud computing. The commissioner in charge of privacy, Viviane Reding, has called for streamlined privacy rules, which currently vary widely across the European Union, with separate enforcement bodies like the French privacy agency overseeing national guidelines.

Google is also facing an antitrust investigation in Brussels, where the European Commission is scrutinizing its dominant position in Internet search. The privacy policies of individual Google services, especially its StreetView mapping feature, have also been investigated in a number of European Union countries.

Ms. Reding had already asked Google to delay adoption of the new privacy policy while regulators assessed its compatibility with European Union law. But the company reiterated on Tuesday that it had no intention of doing so.

"We are confident that our new simple, clear and transparent privacy policy respects all European data protection laws and principles," Peter Fleischer, Google's chief privacy counsel, wrote in a letter to the French privacy agency. He said the company had tried unsuccessfully to meet with the agency to discuss the changes.

"Like all companies, we have struggled with the conundrum of how to pursue both of the CNIL's recommendations: How to 'streamline and simplify' our privacy policies, while at the same time providing 'comprehensive information' to our users," Mr. Fleischer's letter states.

The French privacy agency said in its letter that it would send Google a "full questionnaire" about its privacy policies by mid-March.

In addition to issuing warnings, the French privacy agency has the power to fine companies up to 300,000 euros ($400,000) for privacy breaches in France. It can also seek court orders to try to stop companies from engaging in practices that are deemed to violate data protection laws. Enforcement in other European countries would be up to individual data protection authorities.

Google's new privacy policy applies to services like the YouTube online video platform, the Android mobile phone software and the Google search engine. Users were notified of the changes via e-mail and postings on the relevant sites, among other methods.

The proposed changes have also attracted scrutiny in the United States, where privacy advocates have urged Congress to look into the new policy.

Big Brother Watch, a British privacy advocate, published a study on Tuesday that said only 12 percent of Google users had read the new policy. Forty-seven percent were unaware of the changes, the study showed.

"Google is putting advertisers' interests before user privacy and should not be rushing ahead before the public understand what the changes will mean," the group said in a statement posted on its Web site. [2]

[1] http://www.cnil.fr/fileadmin/documents/en/Courrier_Google_CE121115_27-02-2012-EN.pdf

[2] http://www.bigbrotherwatch.org.uk/home/2012/02/ten-people-havent-read-googles.htm