Joint European action against Google
On the basis of its findings, published on 16 October 2012, the WP29 asked Google to implement its recommendations within four months. After this period has expired, Google has not implemented any significant compliance measures.
Following new exchanges between Google and a taskforce led by the CNIL, the Data Protection Authorities from France, Germany, Italy, the Netherlands, Spain and the United Kingdom have respectively launched enforcement actions against Google.
The investigation led by the CNIL has confirmed Google's breaches of the French Data Protection Act of 6 January 1978, which, in practice, prevents individuals from knowing how their personal data may be used and from controlling such use.
In this context, the CNIL's has decided to give formal notice to Google Inc., within three months, to define specified and explicit purposes to allow users to understand practically the processing of their personal data, and inform users by application of the provisions of Article 32 of the French Data Protection Act, in particular with regard to the purposes pursued by the controller of the processing implemented.
Google also must define retention periods for the personal data processed that do not exceed the period necessary for the purposes for which they are collected, and it must not proceed, without legal basis, with the potentially unlimited combination of users' data.
Google must fairly collect and process passive users' data, in particular with regard to data collected using the "Doubleclick" and "Analytics" cookies, "+1" buttons or any other Google service available on the visited page. The company must inform users and then obtain their consent in particular before storing cookies in their terminal.
The Data Protection Authorities from Germany, Italy, the Netherlands, Spain and the United Kingdom carry on their investigations under their respective national procedures and as part of an international administrative cooperation.
The Spanish DPA has issued to Google his decision to open a sanction procedure for the infringement of key principles of the Spanish Data Protection Law.
The Data Protection Commissioner of Hamburg has opened a formal procedure against the company. It starts with a formal hearing as required by public administrative law, which may lead to the release of an administrative order requiring Google to implement measures in order to comply with German national data protection legislation.
As part of the investigation, the Dutch DPA will first issue a confidential report of preliminary findings, and ask Google to provide its view on the report. The Dutch DPA will use this view in its definite report of findings, after which it may decide to impose a sanction.
The Italian Data Protection Authority is awaiting additional clarification from Google Inc. after opening a formal inquiry proceeding at the end of May and will shortly assess the relevant findings to establish possible enforcement measures, including possible sanctions, under the Italian data protection law. ■