Italy Gives Google A Deadline For Interacting With User Data

Google finds itself in the middle of more controversy in Europe after an Italian data-regulator handed out an 18-month deadline to reform the way it stores users’ information.


Photo: Gil C / Shutterstock

As a result, Google will have to change the way it informs users how their data is collected, modify its data retention strategies, and ask for permission before using the data to build up a profile for advertisers and other purposes.

In other words, Google will have to be ‘clear’ to users that their data is being stored for various purposes such as marketing, and the information isn’t only gathered through cookies, but also through other less popular methods of data collection, such as fingerprinting.

Regulators in several EU countries including Italy made a joint inquiry in 2013 after Google combined 60 privacy policies to create one policy, combining user data collected across its different services, including Google+, Gmail and YouTube. Users were given no option to opt-out.

The Italian watchdog, Data Protection Authority, stated on Monday that Google’s disclosure policy to users on how their collected data was being used wasn’t transparent, despite the company making efforts to comply with the local law. It gave the group 18 months to abide fully and indicated a series of steps that should be put into practice by the search engine giant.

EU’s privacy advocates are concerned that the personal data is being stored in the US, reducing the control European citizens have over their information. The concerns have increased further after NSA whistleblower Edward Snowden revealed that US intelligence agencies were accessing content stored by US-based cloud service providers.

The watchdog suggests that Google needs to introduce a way of giving users a chance to having their data collected by opting-in, or options to opt-out of data collected for specific services, without interrupting their browsing experience.

SafeGov’s president of public sector computing group said:

“We remain concerned that non-consumer users of Google’s services, such as employees, civil servants, patients or schoolchildren, who aren’t able to individually consent to or opt-out of data processing practices, remain at risk of intrusive online tracking.”

What’s next for Google in Italy & Europe?

France, Spain and Netherlands have already taken action against Google for violating local laws earlier in the year.

Google allegedly didn’t comply with the obligation to collect cookies with the consent of the users, and failed to define the periods applicable to the data being processed. Also, it collects data across all Google services without any legal basis.

In the UK too, Google was asked to revise its privacy policies by the ICO (Information Commissioner’s Office), although it is not clear if Google has met the request. However, it was unlikely that the company would have been fined for failing to comply with the demand.

But Italy’s requirement is serious: if Google doesn’t meet the new demand, it could risk a fine of €1 million, and perhaps criminal proceedings. The bigger picture is that Google’s approach to data collection will need to be revamped if the company is to engage with European users.

The right to be forgotten ruling is another reminder of Google’s European woes. The ruling will affect listings obtained in 28 EU countries, as well as in Switzerland, Norway, Iceland and Liechtenstein.

Google has been cooperating with the regulator on a regular basis and would continue to do so, said a spokesman for the company. It would carefully review the decision before taking further steps. Google has also agreed to present a road map of steps by the end of September to comply fully with the Italian watchdog’s decision.

What all this means for an average citizen?

Many Italian citizens may be in favor of Google being more transparent about its data collection policies. Offering transparency about what information is stored on Google’s servers is not only a local requirement, but it is also a way to create a trusting relationship between the company and its customers.

Privacy and requests for sanctions should be integrated into all Google products and services. Fines would hardly trouble the company so it’s essential that action forces the company to respect the privacy policy of its users before meeting the demands of its advertisers.

However, the right to be forgotten would undermine the Internet. Search engines should be library catalogues: they should display information that is neutral and comprehensive, without fear of what contents may reveal. It should be left to Internet users, not governments, to determine what’s wrong or right, immaterial or useful. The right could be abused to hide negative information about those in power.