Google "spins an invisible web of personal data"

Dutch authorities clamp down on Google's practice of combining personal data from different services

Reuters Barry Collins
29 Nov 2013

Google's practice of combining personal data from its many different online services violates Dutch data protection law, the country's privacy watchdog said after a seven-month investigation.

The Dutch Data Protection Authority, or DPA, accused the company of spinning "an invisible web of our personal data, without consent," which is "forbidden by law."

The DPA asked Google to attend a meeting to discuss its concerns, after which it would decide whether to take any action against the company, which could include fines.

Google does not properly inform users which personal data the company collects and combines, and for what purposes

Google, responding to the Dutch authority's findings, said it provided users of its services with sufficiently specific information about the way it processed their personal data.

"Our privacy policy respects European law and allows us to create simpler, more effective services. We have engaged fully with the Dutch DPA throughout this process and will continue to do so going forward," Google said in a statement.

The Dutch decision reflects concerns across Europe about the volume of personal data that is held in foreign jurisdictions in cloud services, giving individuals little control over their personal information.

Privacy campaigners have also pointed to documents leaked by the former CIA technician and National Security Agency contractor Edward Snowden that suggest US intelligence services have access to material stored in US-based cloud services.

In March 2012, Google unilaterally imposed new terms of service on users of all its services, including search, Gmail and YouTube. That decision triggered privacy investigations in six European countries, though the fines regulators can typically impose are modest.

In a previous Dutch case involving the gathering of data from Wi-Fi networks, a spokeswoman for the agency said Google - which has a market capitalization of over $350 billion - could have been fined up to 1 million euros if it had not subsequently complied.

"Google does not properly inform users which personal data the company collects and combines, and for what purposes," the DPA said in a statement.

The report said it was "almost impossible" for a Dutch internet user not to interact with Google "be it via Search, YouTube or Maps, or passively through third-party websites".

Read more about: