"The CNIL and the EU data protection authorities are deeply concerned about the combination of personal data across services," CNIL President Isabelle Falque-Pierrotin wrote in a letter to Google CEO Larry Page on Monday. "They have strong doubt about the lawfulness and fairness of such processing, and about its compliance with European data protection legislation."
In Need of Constructive Feedback
Earlier this month Google rejected the Article 29 Working Party's initial request for a delay. "At no stage did any EU regulator suggest that any sort of pause would be appropriate," Google Global Privacy Counsel Peter Fleischer wrote in a letter to the Article 29 Working Party.
In the letter Monday, however, CNIL's Falque-Pierrotin denied that Google had taken all the necessary steps to fully consult with European authorities.
"We believe we've found a reasonable balance between the Working Party's recommendations: to 'streamline and simplify' our policies while providing 'comprehensive information' to users," Google said in an e-mail statement.
Falque-Pierrotin welcomed Google's efforts to increase public awareness about the changes. However, she said it was regrettable that Google's new policy only provides users with general information about all the services and types of personal data that are involved.
This makes it impossible "for average users who read the new policy to distinguish which purposes, collected data, recipients or access rights are currently relevant to their use of a particular Google service," Falque-Pierrotin said.
By only telling users what Google will not do with their personal data, Google had failed to meet current European regulatory requirements, Falque-Pierrotin said.
"Our preliminary investigation shows that it is extremely difficult to know exactly which data is combined between which services [and] for which purposes -- even for trained privacy professionals," she said.
"In addition, Google is using cookies -- among other tools -- for these combinations and in this regard it is not clear how Google aims to comply with the principle of consent" under European regulations, Falque-Pierrotin added.