Thursday, 31 May 2012

Google's New Privacy Policy: the CNIL Sends Google an Additional Questionnaire

The French data protection authority, the CNIL (Commission Nationale de l'Informatique et des Libertés), was invited by the Article 29 Working Party (which brings together all the data protection authorities of the European Union) to take the lead in the analysis of Google's new privacy policy, which took effect on 1 March 2012.

On 16 March 2012, the CNIL sent Google a detailed questionnaire on its new confidentiality rules (questionnaire). See our post: The French Data Protection Authority Questions Google On Its Privacy Policy.

On 5 and 20 April 2012 Google answered the first questions.

The CNIL considered that Google's answers are often unclear and/or incomplete, and therefore sent an additional questionnaire on 22 May 2012; Google's reply is expected for 8 June 2012.

The CNIL wants clear explanations regarding:
- the processing of personal data (links between the collected data, the purpose and the recipients);
- the maximum retention period of the data;
- the combination of data services (purpose and breadth of the combinations),
- the actual effects of Google's opt-out mechanisms and the validity as a means to exercise the right to oppose;
- the way in which the ePrivacy Directive is applied for "passive users" of Google's services (advertising, analytics, +1 button) when they visit third-party sites.

After receiving Google's answers, the CNIL will then present its report to the Article 29 Working Party, which will state its position and send to Google, before mid-July, its recommendations as to the improvements that should be made in order to comply with the European data protection rules.

Read the additional questionnaire sent to Google: Additional questionnaire