Google to change its Privacy Policy

Google continues to make headlines in relation to personal data. It is currently working to resolve the issues resulting from the Court of Justice of the EU’s ruling last year that Google must take down links to any content that is “inadequate, irrelevant or no longer relevant”. This ‘right to be forgotten’ ruling has caused a great deal of debate as to whether free speech will be stifled as a result. However, on a related subject, and following an investigation from the UK Information Commissioner’s Office (ICO), Google has agreed to change its privacy policy.

The investigation follows Google’s introduction of a privacy policy in March 2012 which combined approximately 70 existing policies for various services into one. However the ICO ruled that such policy did not include sufficient information for service users to find out how and why their personal data was being collected. The ICO found that Google was “too vague when describing how it uses personal data gathered from its web services and products”.

Google has now signed a formal undertaking to improve the information it provides to people about how it collects personal data in the UK to ensure that it meets the requirements of the Data Protection Act. Google must now make the changes by
30 June 2015 with further commitments over the next two years.

The full list of steps Google must take under the undertakings are as follows:

Carry out the steps set out in Annex 1 of the Undertaking to ensure that its privacy policy is accessible and easy to understand.
Ensure that there is continued evaluation of the privacy impact of future changes to processing which might not be within the reasonable expectations of service users so that users are provided with prompt and adequate notice of such processing.
Keep the content of the Privacy Policy and associated web content under review and take appropriate actions so that service users are informed as to the ways in which their personal data may be processed.
Keep the overlay examples for the Privacy Policy under review to ensure that informative and relevant examples are always in use.
Continue to ensure that any significant future changes to the Privacy Policy are reviewed by user experience specialists and with representative user groups before the policy and associated tools are launched as appropriate.
Continue to pro-actively co-operate with the Commissioner and provide appropriate advance notice of any significant changes, and respond promptly to enquiries relating to the ways in which Google processes user data and its proposals for consequential changes to the Privacy Policy and supporting web content.
Provide a report to the Commissioner by August 2015 setting out the steps which the data controller has taken in response to the commitments set out in this undertaking.

If you wish to discuss any of the issues raised in this article please contact Simon Miles, Karen Lee or any member of the Edwin Coe Intellectual Property team.

Please note that this blog is provided for general information only. It is not intended to amount to advice on which you should rely. You must obtain professional or specialist advice before taking, or refraining from, any action on the basis of the content of this blog.

Edwin Coe LLP is a limited liability partnership registered in England and Wales (No. OC326366) and is authorised and regulated by the Solicitors Regulation Authority. A list of members of the LLP is available for inspection at our registered office: 2 Stone Buildings, Lincoln's Inn, London WC2A 3TH. "Partner" denotes a member of the LLP or an employee or consultant with the equivalent standing. Our privacy notice which we are obliged to give you under the GDPR is available here.

Please also see a copy of our terms of use here in respect of our website which apply also to all of our blogs.