The shoe has finally dropped for Google. Yesterday, European regulators at France's Commission Nationale de L'Informatique et des Libertés (CNIL) gave the business a three- to four-month deadline to make changes to its privacy policy.
Interesting stories sometimes take time to unfold. It was on March 1, 2012, that Google launched a new, global privacy policy. A so-called "privacy" policy, at least, because its actual effect was to gather users' history with Search, Gmail, YouTube, Google+, and other services into a single profile.
This pooling of information from various sources certainly allowed Google to simplify its privacy rules. It was also viewed as a pretext for collating sets of valuable personal information, in part as a competitive response to Facebook. What's more, users were not permitted to "opt out."
It was bound to come under close scrutiny from privacy-sensitive European regulators.
CNIL was invited to examine the new policy on behalf of regulators across the EU, and it has certainly moved with cautious deliberation. Yesterday, however, it made its views clear: Change the policy or face fines.
Specifically, CNIL has asked Google to:
- Make the policy clearer
- Give users control over the combination of data across channels
- Modify its tools to avoid excessive collection of data, and introduce retention periods.
Of course, enabling users to maintain a "Chinese wall" between, say, their YouTube history and their Gmail history would make nonsense of the unified policy. But does Google have any choice?
On the one hand, CNIL's bark may be worse than its bite. While the €100,000 (US$131,210) fine it levied over improper collection of Street View data is the largest it has ever handed out, it's equivalent to about one month's salary for Eric Schmidt.
On the other hand, it's hard to see how Google could persist in defying the law, not only across the EU, but in other territories too, if regulators in Canada, Australia, and Asian countries -- who have been monitoring the EU process closely -- follow suit. Indeed, several countries have already explicitly endorsed CNIL's findings.
The FTC, which has already signed a consent decree over Google Buzz privacy issues, and continues to threaten Google with anti-trust litigation, remains a hold out. Though the agency has yet to express its views, it's difficult to see, in this globally connected era, how Google could operate one privacy policy in the USA and a different privacy policy in the rest of the world.
Google continues to insist that its new policy is consistent with EU law -- in other words, that CNIL is just wrong. That's a high-stakes position to take, and the search giant doesn't seem to be holding much of a hand in this protracted poker game.
We must now wait to see whether Google will fold or call.
Related posts:
— Kim Davis 
, Community Editor, Internet Evolution
Email This
