France threatens Google with privacy fines

PARIS -- France is giving Google three months to be more upfront about the data it collects from users — or be fined. Other European countries aren't far behind.

Now it's up to Google to decide whether the relatively small fines are enough of an incentive to rethink its privacy rules — the Internet giant risks a €300,000 euro ($402,180) penalty in France.

Europe's a big market, but one where Google has no serious competition.

However, the company does have a reputation problem when it comes to protecting user privacy. Thursday's legal action puts new pressure on Google, which is smarting from criticism over providing customer data to the U.S. government as part of its fight against foreign terrorists.

The French agency that regulates information technology says that five other European countries are taking similar steps in a staggered offensive against Google's privacy policy between now and the end of July. It says Google largely ignored earlier recommendations from European regulators.

Spain's Data Protection Agency said Thursday that it had initiated sanction proceedings after initial investigations showed Google Spain and Google Inc. may be committing six infractions against the country's data protection law. It said the company could also face fines of up to 300,000 euros.

The French National Commission on Computing and Freedom, known as CNIL, said Britain, Germany, Italy and the Netherlands will join the procedures in the coming weeks.

The legal action accelerates a long-running European fight against Google over privacy, which is more rigorously protected in many European countries than in Google's homeland, the United States.

A spokesman for Google said Thursday that it believes its privacy practices respect European laws.

"We have engaged fully with the authorities involved throughout this process, and we'll continue to do so going forward," said Al Verney.

Paris' formal warning gives the company three months to make changes to its privacy practices. They include specifying to users what it is using personal data for, and how long it's held.

Regulators also want Google to let users opt out of having their data centralized — for example, when data from online searches, Gmail and YouTube are crunched into a single location.

If not, Google risks a fine of up to 300,000 euros by France, which could eventually mean millions of euros in penalties across all six countries. By comparison, Google's revenues were $14 billion in the first quarter of this year, much of that from advertising — which is boosted by the Internet giant's ability to target users based on what they read, watch and buy online.

In Britain, the Information Commissioner's Office said its investigation into whether Google's privacy policy complies with UK law is still underway and it will soon contact Google about its preliminary findings.

The Dutch privacy watchdog, the College for the Protection of Personal Data, said it is investigating Google's "privacy conditions" but spokeswoman Lysette Rutgers declined further comment while the investigation is ongoing.

France's data protection agency led a European investigation last year into Google's privacy policy.

"French law demands that when you're collecting information about someone, you need to collect it for a precise reason," said CNIL president Isabelle Falque-Pierrotin.

She said the outcry about the role of Google and other online players in government surveillance illustrates that users want transparency about where their data goes.

Google's image has suffered since it was identified this month as one of nine U.S. Internet companies that gave the National Security Agency data on its customers, as part of the agency's efforts to track foreign threats to U.S. national security. Revelations about the program, known as PRISM, by a former NSA contractor has opened a debate about the privacy of Americans' communications.

In the European privacy dispute, Nick Pickles of Britain-based watchdog Big Brother Watch said, "There's a real worry that (the European fines) won't be a particularly strong deterrent, that Google may see it as a price of doing business."

"People shouldn't be able to ignore people's rights and the law, make huge profits and then continue acting as if nothing was amiss," he said.

Pickles noted that many European countries are limited by laws on data protection that date from before Google was even born 15 years ago.

EU Justice Commissioner Viviane Reding proposed last year that the maximum penalties for privacy matters be raised from the current €600,000 to 2 percent of a company's global sales.

The legal action could also impact huge trans-Atlantic trade negotiations that President Obama announced on Monday.

In the wake of the NSA data snooping scandal, several EU officials and politicians want data protection issues to be at the heart of the trade talks. The U.S. Ambassador to the EU expressed concern Thursday that privacy issues shouldn't dominate the talks.