• Categories

  • Archives

    « Home

    Update: Canada Raises Questions about Google’s Privacy Policy Changes

    Several weeks ago,  Google announced changes in its privacy policies that will affect users of its services, such as search, Gmail, Google+ and YouTube as of March 1. Advocates and legislators questioned the changes, saying that there were privacy issues, and criticized (pdf) the Internet services giant for not including an opt-out provision; Google said that users who objected could stop using its services and move their data elsewhere. Recently, 36 U.S. state attorneys general wrote to (pdf) Google raising privacy and security questions about the announced privacy policy changes. The data protection authority in France (the National Commission for Computing and Civil Liberties, CNIL) has completed a preliminary investigation (pdf) of Google’s changes and said the findings suggest the company may be headed toward violations of the European Data Protection Directive.

    Jennifer Stoddart, the Privacy Commissioner of Canada, has written to Google asking for more information on the privacy changes, because there are concerns the company would be violating Canadian privacy law:

    As we understand it, Google has a number of goals that it wishes to achieve through this effort. Primarily, the company is aiming to reduce the number of privacy policies that currently exist (over 70) in relation to its many different products and services to one general privacy policy. In addition to that general policy, Google will still retain a small number of product-specific policies (e.g., for Google Wallet) where it believes that this makes sense or is otherwise required by law. The other goals are to create a simpler, more intuitive user experience across multiple Google products; improve search results; and make ads more relevant. […]

    Under the current policy, data sharing already takes place across certain products. For example, Google makes it easy for a signed-in user to immediately add an appointment to Google Calendar if an incoming e-mail looks like it is about a meeting. For other products, such as Search and YouTube, the data that Google collects about how individuals use a particular product have been kept separate. Specifically, a user’s general search history would not be used to improve search results on YouTube. Considering that an individual’s search history can be quite unique and sensitive (indicating vital facts about the person’s location, interests, age, sexual orientation, religion, health concerns, and much more), this was an important privacy protection.

    We understand that, under the new policy, Google is removing this separation between its various products. In other words, Google will be linking all of a user’s data together when the user logs into his/her account and uses various services. According to Google, “information is associated with a given user only if the user is signed into their Google Account. If a user maintains two separate Google Accounts – for example a work account and a personal account – Google will not use information about one account to personalize the other”. As we understand it, the policy changes do not mean that Google is collecting more information about its users than it currently does. They do, however, mean that you are going to be using the information in new ways – ways that may make some users uncomfortable. We would strongly encourage you to make it clearer to users that if they are uncomfortable with these new uses of information, they can create separate accounts. This is not clearly stated in your new policy; rather, the information about the separate accounts was clarified in one of the letters from a Google senior executive in response to queries by the Article 29 Working Party. […]

    A further concern regarding the personalization of services comes from language in the new policy, where Google states that it “may use the name you provide for your Google Profile across all of the services we offer that require a Google Account. In addition, we may replace past names associated with your Google Account so that you are represented consistently across all our services”. It is not entirely clear how this process would work and just how far it would extend. For example, will Google attempt to link existing accounts to each other or new accounts with previous accounts, either of which would contradict statements by the company that users can create and maintain separate accounts? We would appreciate your clarification of this issue.

    Read the full letter to learn about the privacy commissioner’s concerns about how Google’s changes affect users of Android devices.

    Leave a Reply