ICO Sets Deadline for Google over Data Protection Compliance

The Information Commissioner’s Office (ICO) has stated that a review of Google’s privacy policy has raised serious concerns. The ICO has questioned whether in its current form it conforms with requirements under the UK Data Protection Act (DPA).

The ICO has issued Google a deadline of 20 September 2013 by which time it must have amended its privacy policy to ensure that it is DPA compliant. The ICO highlighted that the updated policy, issued by Google fails to “provide sufficient information to enable UK users of Google’s services to understand how their data will be used across all of the company’s products”.

This is not the first time this policy has drawn criticism and calls for amendments. The policy in its current form is the result of Google producing one single, all encompassing, privacy policy covering all its varied services, including YouTube, its Blogger service and Gmail. This was released in March 2012 and prompted the Article 29 Working Party to consequently appoint the French DPA (CNIL) to assess the policy’s compliance with EU data protection laws. Following this assessment the CNIL concluded that the policy was not compliant and requested changes.

Google however, failed to alter the policy. Consequently, individual DPA watchdog authorities across Europe convened to form a taskforce, agreeing to potentially place separate levies on Google for the breaches resulting from the policy. This recent statement by the ICO is the result of that coalition. In addition to the ICO’s action, the Spanish DPA (AEPD), and the CNIL have also set deadlines. Italy and the Netherlands are also currently in the process of issuing its own warnings against Google.

Google has repeatedly argued that their policy is compliant and does not require alterations. Should they fail to amend their policy or provide more detailed information to users relating to their data, the ICO has warned Google that it may face formal enforcement action in addition to possible action from other individual authorities across Europe.

Amongst the options of enforcement action at the ICO’s disposal are: Monetary Penalty Notices (of up to £500,000 for any serious breach), Enforcement Notices, Decision Notices or pursuing Criminal Prosecution.