Spain’s data protection authority has fined Google $1.2 million and ordered the company to fall in line with the country’s data protection rules without delay.
The Agencia Española de Protección de Datos (AEPD), said Thursday that Google does not provide users enough information about the personal information it collects, and the purposes it uses it for. It also objects to Google combining data gathered from its various services in violation of local laws.
The Internet company does not, for example, inform Gmail users that the content of mails and attached files are filtered to insert tailored advertising, AEPD said.
Google is also said to keep the data for periods longer than permitted under local data laws. The company was fined $409,500 for each of three violations, AEPD said.
”The combination of data collected through different services widely exceeds the reasonable expectations of the majority of users, who are not aware of it and lose control of their own personal information,” AEPD said.
Google modified its privacy policy in March 2012, giving it the right to use personal data collected from one service on its other services as well, triggering criticism from privacy experts.
Violates data protection laws
The investigation carried out by the AEPD has shown that Google illegally collects and processes personal information of both authenticated users, who have logged in with their Google accounts, and non-authenticated users, as well as “passive users” who have not requested Google’s services but access Web pages that include elements managed by the Internet company, the data protection authority said.
”Google collects personal information through nearly a hundred of services and products offered in Spain, in many cases not providing adequate information about what data is collected, what data is used for what purposes and without obtaining a valid consent of the data subjects,” AEPD said.
Data protection authorities from France, Germany, Italy, Spain, the Netherlands, and the U.K. said in April they will conduct formal investigations of Google’s privacy policy, after the company rejected their requests that it reverse changes it made to the policy. French data protection agency Commission Nationale de L’Informatique et des Libertes (CNIL), which was leading the inquiry, had published in October 2012 a report, giving Google four months to comply with its recommendations. The company did not comply significantly with the recommendations, CNIL said.
”We’ve engaged fully with the Spanish DPA throughout this process to explain our privacy policy and how it allows us to create simpler, more effective services, and we’ll continue to do so,” Google said in a statement. “We’ll be reading their report closely to determine next steps.”