By not informing its users about what data it collects and by not asking for permission, Google is breaking the Dutch data protection act, privacy watchdog CBP said in a press release last Thursday.

In 2012 Google changed its privacy policy. The American Internet giant started combining the private data it collects from its users across all its services.

The investigation shows that Google combines personal data relating to Internet users that the company obtains from different services. Google does this, amongst others, for the purposes of displaying personalised ads and to personalise services such as YouTube and Search. Some of these data are of a sensitive nature, such as payment information, location data and information on surfing behaviour across multiple websites. Data about search queries, location data and video’s watched can be combined, while the different services serve entirely different purposes from the point of view of users.

Internet lawyer Arnoud Engelfriet points to a peculiarity of Dutch privacy law that says you have to ask users for informed consent. It’s not enough to say ‘this is how we deal with your privacy’, users should be able to understand what is going to happen and say ‘no’ before it happens. Also, Google shouldn’t say what they could do with your data, they are obliged to say what they will do with your data.

Apparently Google tried to defend themselves by claiming they do not collect personal data, they merely create profiles. CBP quotes Google’s own CEO Eric Schmidt back at them who once stated: “We don’t need you to type at all. We know where you are. We know where you’ve been. We can more or less know what you’re thinking about.” Google’s chief Internet evangelist (and Internet co-inventor) Vint Cerf said two weeks ago at a privacy and security workshop of (of all people) the US Trade Commission (40 minutes into the video): “I would not go as far as to simply, baldy assert that privacy is dead. […] But let me tell you that it would be increasingly difficult for us to achieve privacy. I want you to think for just a minute about the fact that privacy may actually be an anomaly.”

Engelfriet concludes: “Google of course believes the criticism is invalid and uses a barrage of marketing language […] to keep dancing around the issue. And that is all that will happen. I don’t see what kind of effective measures CBP can take to make Google fundamentally change its ways—which is a pity, because this is one of the most substantial reports CBP has issued in a long time.”

(Link: the Register; photo by Jeff Schuler, some rights reserved)