WIREDGOV

The ICO has required Google to sign a formal undertaking to improve the information it provides to people about how it collects personal data in the UK after concerns were raised around changes to the company’s privacy policy.

The ICO found that the search engine was too vague when describing how it uses personal data gathered from its web services and products.

Google introduced a new privacy policy in March 2012 combining around 70 existing policies for various services, but the ICO ruled that the new policy did not include sufficient information for service users as to how and why their personal data was being collected.

Google has now signed an undertaking committing to make further changes to the privacy policy to ensure it meets the requirements of the Data Protection Act and to take steps to ensure that future changes to its privacy policy comply, including user testing.

Whilst conducting its own investigation, the ICO has worked with other European Data Protection Authorities, as part of the Article 29 working party.

Steve Eckersley, Head of Enforcement at the ICO, said:

“This undertaking marks a significant step forward following a long investigation and extensive dialogue. Google’s commitment today to make these necessary changes will improve the information UK consumers receive when using their online services and products.

“Whilst our investigation concluded that this case hasn’t resulted in substantial damage and distress to consumers, it is still important for organisations to properly understand the impact of their actions and the requirement to comply with data protection law. Ensuring that personal data is processed fairly and transparently is a key requirement of the Act.

"This investigation has identified some important learning points not only for Google, but also for all organisations operating online, particularly when they seek to combine and use data across services. It is vital that there is clear and effective information available to enable users to understand the implications of their data being combined. The detailed agreement Google has signed setting out its commitments will ensure that.”

The ICO has already worked with Google to ensure a significant number of changes to the policy. The search engine must now make the agreed further changes by 30 June 2015 and take further steps over the next two years.

The ICO plans to update its Privacy Notices Code Practice later 2015 to provide organisations with further guidance about how to provide effective privacy information, particularly in online and mobile environments.

Google Inc undertaking

Action we've taken

Timeline

24 January 2012 
Google announces it will merge a number of its privacy policies to create one policy for all its products and services on 1 March 2012.

2 February 2012
Article 29 Working Party, the group of EU data protection authorities, including the ICO, informs Google it will be analysing the new privacy policy, and request the company delay its launch until the analysis is complete.

1 March 2012
Google launches the new privacy policy, a combination of 70 other policies.

16 October 2012
Article 29 Working Party concludes that the new privacy policy is not compliant with the European Data Protection Directive 95/46/EC with regard to the processing of personal data. Recommendations to make the policy compliant are put to Google with a deadline of 15 February 2013.

26 February 2013
Article 29 Working Party establishes a taskforce with representatives from the French, Spanish, Italian, German, Dutch and UK data protection authorities. Its purpose is for the authorities to consider the privacy policy’s compliance with their respective national laws. Google now has to consider EU recommendations and individual recommendations from each separate country’s data protection authority.

19 March 2013
Google meets with representatives of the taskforce and sets out some measures which it will implement further to the original recommendations of the Article 29 Working Party.

4 July 2013
The ICO writes to Google to say the privacy policy does not meet with the First and Second Data Protection Principles which are set out in Schedule 1 Part I of the UK Data Protection Act (fair processing)

6 December 2013
Google proposes a number of changes to the privacy policy with two phases of implementation, the first on 31 March 2014, and the second on 30 June 2014. The company then makes the changes, as proposed, by the respective deadlines whilst engaging in dialogue with the ICO and incorporating feedback on the proposed changes which the ICO had made.

23 September 2014
Article 29 Working Party writes to Google setting out a number of recommendations which have been agreed by the European data protection authorities, including the ICO,

2 December 2014
Google responds to the Article 29 Working Party recommendations setting out a number of improvements aimed at addressing the Working Party’s concerns.

21 January 2015
Following a period of dialogue and engagement with the ICO Google agrees to sign an undertaking committing to all the changes suggested by 30 June 2015, with ongoing commitments for the next two years.

Notes to Editors

1. The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
2. The ICO has specific responsibilities set out in the Data Protection Act 1998, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.
3. The ICO is on Twitter, Facebook and LinkedIn. Read more in the ICO blog and e-newsletter.Our Press Office page provides more information for journalists.
4. Anyone who processes personal information must comply with eight principles of the Data Protection Act, which make sure that personal information is:

• Fairly and lawfully processed
• Processed for limited purposes
• Adequate, relevant and not excessive
• Accurate and up to date
• Not kept for longer than is necessary
• Processed in line with your rights
• Secure
• Not transferred to other countries without adequate protection

5. Civil Monetary Penalties (CMPs) are subject to a right of appeal to the (First-tier Tribunal) General Regulatory Chamber against the imposition of the monetary penalty and/or the amount of the penalty specified in the monetary penalty notice.
6. Any monetary penalty is paid into the Treasury’s Consolidated Fund and is not kept by the Information Commissioner’s Office (ICO).