Dutch Privacy Watchdog: Harsh Sanctions For Combining User Data Without Informed Consent

In a recently published enforcement action against Google, the Dutch Data Protection Authority confirmed its earlier position that combining personal data from various services without the prior unambiguous consent of individuals violates Dutch data protection laws. Google had collected and combined personal data of internet users in order to provide personalised services or display personalised ads. Google breached data protection law by failing to adequately inform users about the combining of their personal data from various sources, and by not obtaining users' prior consent for such combination. According to the Dutch Data Protection Authority, processing of the personal data in this case cannot be based on other legitimate grounds, for instance legitimate interest, because the combining of personal data has a significant impact on users' privacy and cannot be foreseen by them.