Google gets 3 months to fix privacy

France gave Google Inc three months to amend its policy regarding internet users' data to avoid fines, and said five other European countries will follow suit by the end of July.

The US search engine giant is breaching French laws because it "prevents individuals from knowing how their personal data may be used and from controlling such use," France's National Commission for Computing and Civil Liberties, the country's data protection watchdog known as CNIL, said today in a statement in Paris. It ordered Google to comply with the French Data Protection Act.

"France, Spain, the UK at the start of next week and Germany at the end of next week will all take a formal and official decision to start repressive proceedings against Google, and a second salvo will come from Italy and the Netherlands by the end of July," Isabelle Falque-Pierrotin, Chairwoman of the French authority, said.

Google faces probes across Europe over changes to harmonise privacy policies for more than 60 products last year. Global data protection regulators this week wrote to the Mountain View, California-based company urging Chief Executive Officer Larry Page to contact them about possible issues with its web-enabled eyeglasses, called Google Glass.

"Our privacy policy respects European law and allows us to create simpler, more effective services," Al Verney, a spokesman for Google in Brussels, said by phone. "We have engaged fully with the data protection authorities involved throughout this process and will continue to do so going forward."

Gmail messaging
The French data protection watchdog ordered the company to spell out for users why it collects information "to understand practically the processing of their personal data," better inform users of its privacy policy, and "define retention periods of personal data processed that do not exceed the period necessary for the purposes for which they are collected".

CNIL is also asking the owner of the Gmail messaging system to request users' permission for "the potentially unlimited combination" of their data, ask users' approval to collect their data with tools such as the "Doubleclick" and "Analytics" cookies, "+1" buttons or any other Google service on third-party websites, and "inform users and then obtain their consent in particular before storing cookies in their terminal".

The formal notice "isn't very prescriptive," Falque-Pierrotin said. "We're leaving Google some leeway to reach compliance."

Maximum fine
CNIL can levy a maximum fine of euro 150,000 ($198,200), and euro 300,000 in case of a repeated offence, she said. Other regulator may impose sanctions of up to euro 1 million, potentially exposing Google to "several million euros" of fines on top of damaging its image, she said.

The French watchdog's most severe fine to date was euro 100,000 against Google in 2011 for breaches related to its Street View mapping service.

The six privacy regulators started "coordinated" enforcement measures in April over the company's failure to address complaints about its new privacy policy. The French agency led a review on behalf of other authorities to review whether Google's revisions to its policies violated EU standards.

"Beyond the legal framework which must be respected, the order largely reflects Google users demand for transparency, for ownership of their navigation and online life," Falque-Pierrotin said.