Brussels, 29/02/2012 (Agence Europe) - The French data protection agency, the Commission nationale de l'informatique et des libertés française (CNIL), wrote to the American search engine Google on 28 February asking it to delay the entry into force of its new confidentiality rules, scheduled for this Thursday 1 March, and which the CNIL feels are incompatible with European law.
The CNIL is behind an initiative launched by the “Article 29” group of European regulators tasked with verifying the conformity of European texts, international agreements or other policies with European provisions on the protection of personal data, in this case the directive of 1995 (a revision of which Viviane Reding proposed on 25 January.). On 3 February, the group announced an investigation into these confidentiality rules and asked Google to postpone them.
The CNIL has several criticisms of Google, even though it started by welcoming the tabs placed on Google sites to warn internet users of the changes to the rules. First of all, the CNIL refutes Google's claims that all the competent authorities of the EU were consulted before its new policy was announced on 24 January. “All of the authorities were not informed”, writes the CNIL and some of them were notified only “a few hours” before this new confidentiality policy was launched.
This policy consists of a merger of nearly 60 confidentiality rules and the application of a single confidentiality policy for all of its services (gmail, google+, youtube, GoogleMaps...). Where the CNIL has a problem is that the information given by Google on the reasons for the collection and use of internet users' data is too “general” and it is impossible for users to know how their data will be dealt with when they visit specific sites.
The CNIL feels that Google's new rules do not therefore respect the requirements of the 1995 directive as regards the information of the people concerned. Google should add to its confidentiality policy with specific information for each service and each end use, it states.
Another concern is the overlapping of the data. “Rather than promoting transparency, the terms of the new policy and the fact that Google claims it will combine data across services raise fears and questions about Google's actual practices”. With its new rules, Google will be able to offer advertising targeted to one service using information provided by the users on another service.
The CNIL and the European data protection authorities are therefore “deeply concerned about the combination of data across services” and have “strong doubts about the lawfulness and fairness of such processing”. The CNIL states that it will send a new questionnaire to Google by mid-March. Reding, for her part, on Tuesday welcomed the position of the CNIL and the European regulators, also calling on Google to postpone its new policy until questions regarding its compliance with European rules are settled, she said in a press release. The American search engine has however already stressed that it will not hold up the “global” launch of its new policy, which is still scheduled to go ahead this Thursday 1 March. (SP/transl.fl)