European privacy regulators have been critical of Google’s unified privacy policy since it was announced in early 2012. They have demanded various changes, including more disclosures to users, to bring the law in compliance with EU and individual country rules.
Italy is the latest country to issue what amounts to an ultimatum to Google to change its privacy practices or face fines (up to $1 million euros) and unspecified “possible criminal proceedings,” according to Reuters.
There is a similar history in France, which ordered Google to change its privacy behavior in June 2013. Google maintained it was in compliance with applicable rules and declined to make the requested changes.
Earlier this year the French fined Google and subjected it to a public shaming: the company was ordered to post a notice on its homepage that announced the fine and the non-compliance behind it. Google unsuccessfully challenged the order to post the notice, which read as follows:
Playing out the same pattern as in France, Italian privacy authorities have given Google 18 months to make the requested changes. According to Reuters:
The Rome-based regulator said Google would not be allowed to use the data to profile users without their prior consent and would have to tell them explicitly that the profiling was being done for commercial purposes. It also demanded that requests from users with a Google account to delete their personal data be met in up to two months.
To comply with the Italian mandate Google would need to inform Italians that it was using their search histories and other online data to serve ads and ask them to opt-in to that practice. It’s uncertain whether Google will make any changes; it has pledged to study the Italian order.
The fines available to the European regulators are currently small and therefore relatively meaningless to Google. However there are initiatives to make available stiffer monetary penalties in the future.
Google could (and I suspect does now) see these fines as simply a cost of doing business in Europe. The company is more concerned about harm to its image or reputation, as the French example illustrates.
The Italian case is merely the latest in a long line of privacy disputes between Google and Europe, most recently expressed in the Right to Be Forgotten. Beyond Italy and France, courts and regulators in The Netherlands, the UK, Belgium and Germany have found Google’s privacy policies and practices to be in violation of their local laws.
Comments