The Dutch Data Protection Authority (CBP) has recently imposed an incremental penalty on Google in respect of its breach of the Dutch Data Protection Act in respect of its privacy policy which is ambiguous and unclear in respect of the way in which personal data is collected, processed and shared between the differing Google services.
The penalty is incremental in that the longer Google takes to comply with the requirements of CBP the greater the fine.
We understand that the sanction could amount to as much as €15 million assuming that Google does not:
- ask for the unambiguous consent of users for the combining of personal data from different Google services via a separate consent screen;
- improve its privacy policy to give clear and consistent information to users as to how personal data is being used by the different Google services; and
- provide clear information about the fact that YouTube is part of Google.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
