Time for action on Google’s privacy policy


In a statement issued today, it was announced six European data protection authorities are to launch coordinated and simultaneous enforcement actions relating to Google’s privacy policy.

We raised concerns at the time about how the “simplified” privacy policy made it possible for Google to combine data from across a whole range of services, without consumers being able to understand what happens to their data or to choose to not share their data in this way.

Google has repeatedly put profit ahead of user privacy and the way that the company ignored concerns from regulators around the world when it changed its privacy policy showed just how little regard it has for the law.

As our research in February found, more than 7 in 10 (71%) of the British public say that privacy and data regulators were right to investigate Google’s privacy policy and how it allows Google to collect and combine data on consumers. A clear majority (66%) of the British public say that national regulators should be doing more to force Google to comply with existing European Directives on privacy and the protection of personal data.

Just because Google is a big business does not put it above the law. The company has ignored the authorities and refused to make any meaningful changes to how it collects sand uses people’s data.

Consumers are increasingly concerned about how their data is being used and it is essential that those breaking the law are properly punished. It is essential regulators find a sanction that is not just a slap on the wrists and will make Google’s think twice before it ignores consumer rights again.

One area of particular concern is the fact that an increasing number of British public sector organisations are using cloud based services, including those provided by Google. We question if, given the clear statement from European data protection reglators, it should be made clear that no British citizens personal information should be uploaded to a Google cloud server. Perhaps such a step would be more effective than a simple financial penalty.

Those who flout the law, and the concerns of regulators, should not be able to carry on doing business without any hindrance. Google ignored warnings about its new privacy policy and kept consumers in the dark about what it meant for their data.

The question is not whether action should be taken, but if the action that will be taken is really enough to force Google to change it’s ways.