If Google doesn’t change how it handles users’ private data by the end of February, it may face fines of €15 million (about US$18.6 million), the Dutch Privacy Authority said Monday.
Google’s current privacy policy breaches several provisions of the Dutch data protection act, the regulator found in an investigation in 2013. In particular, the probe showed that Google breaches the law when it combines data from different services like search queries, location data and videos watched.
“Google catches us in an invisible web of our personal data without telling us and without asking us for our consent. This has been ongoing since 2012 and we hope our patience will no longer be tested,” said Jacob Kohnstamm, chairman of the Dutch DPA.
By the end of February, Google should get “unambiguous consent” from its users before it combines personal data from different Google services to serve targeted ads, the DPA said. This could for instance be achieved by introducing a separate consent window.
Moreover, Google should also give clear and consistent information in its privacy policy to people who use several Google services.
Google’s privacy policy has been under fire in the European Union since an updated was presented to users in 2012. Data protection authorities in France, the U.K., Germany, Italy, Spain and the Netherlands launched formal investigationsy in 2013 after the company repeatedly rejected requests to reverse its changes.
Google recently sent a letter to the six DPAs, announcing a number of measures to comply with EU privacy laws. The Dutch DPA “has not yet established whether the proposed measures will end all the violations,” it said.
“We’re disappointed with the Dutch DPA’s order, especially as we have already made a number of changes to our privacy policy in response to their concerns,” a Google spokesman said, adding that Google will soon discuss the proposals with the European DPAs.
Google was already fined €150,000 by French privacy authority CNIL in January. That fine followed a €900,000 fine from the Spanish data protection authority last December.