Google's revised privacy policy came into effect this month. Photograph: Martin Keene/PA
Google's privacy policy is "too vague" for users to control how their information is shared, according to the UK's data protection boss.
In his first public comments since Google's revised policy came into effect on 1 March, deputy information commissioner and data protection head David Smith said he was concerned that information is now being shared between some 60 Google services, including mail, calendar, Android phone call logs and search histories.
"Google's privacy policy is too vague," said Smith. "The requirement under the UK data protection act is for a company to tell people what it actually intends to do with their data not just what it might do at some unspecified point in future.
"Being vague does not help in giving users effective control about how their information is shared. It's their information at the end of the day."
Last week the French watchdog CNIL, acting on behalf of Europe's national regulators, asked Google not to roll out its new policy on the grounds that it breached data protection laws. The company pressed ahead regardless, saying that after publicising the change for a month a reversal now would confuse consumers.
For the first time Google plans to share data amassed by separate services, but the company, which controls 80% of European searches, 30% of European smartphones and 40% of online video globally, has not spelt out in detail what will be shared and with whom. One of the examples given is that if other users already have your email, or other information that identifies you, Google may show them your publicly visible Google Profile information, such as your name and photo.
The CNIL warns that Google will be able to display ads on Youtube that relate to a user's recent search activity or data collected from an Android phone. Advertising could in future be tailored to the location of meetings logged in a user's Google Calendar service. The company says this is not currently happening and users will be warned of changes.
According to Google, Android's servers collect and store phone call logs with numbers dialled and the time, date and duration of calls. This information is not currently shared, a Google spokesman said. While Europe's data protection laws are strong, Google can hold personal information abroad, raising fears that it could be hacked or seized. The company says its security measures are state of the art and uniform around the world.
Google also warns that the companies which make apps downloaded from its Android store are not obliged to follow its guidelines about how information they collect is used and shared. But Android app makers do have to declare what data they collect and are actively policed by Google.
A spokesman for the company said: "The most important product-specific privacy explanations have been incorporated into our main Privacy Policy. And there are lots of ways to communicate more about our product-specific privacy practices without creating formal privacy notices. For example, we use our Privacy Center, Help Center articles, in-product notifications, published FAQs and our Good to Know website to explain what information we collect and how we use it."
Smith said that he wanted to see search engines like Google included in European legislation being drawn up to give consumers a "right to be forgotten" by the internet. The 'Facebook fired' phenomenon has seen a wave of employees lose their jobs because of information revealed about them in social media.
"Google can't just say: I'm just a messenger I have no responsibility at all for the messages I carry," he said. "Given their dominant role and their huge influence here they have a responsibility to ensure they operate in a fair and reasonable way. Where things are drawn to their attention and it can be established they are delivering content which is defamatory, where it is harmful to individuals and there is no public interest justification Google have a responsibility not to serve up that information."
The law for now protects Google from prosecution over defamation. The high court recently ruled that the company could not be sued for allowing damaging comments about a Conservative councillor, Payam Tamiz, to be published on its Blogger.com service.
The CNIL will report its preliminary findings on whether Google's privacy policy breaches the law at the end of March, and national regulators have vowed to take co-ordinated action.
Smith said depending on the findings, the information commissioner could order Google to stop sharing information "in a way which hasn't been properly explained" or which people had not consented to. The commissioner's sanctions include fines and criminal prosecutions.
"We have to keep these massive tech giants in check," said Georgina Nelson, a lawyer for the consumer group Which?. "People need to be reassured that they are dealing with their data in the right ways."
No comments:
Post a Comment