Google fined EUR 900,000 by Spanish data protection agency

Spain's Data Protection Agency (AEPD) has fined Google a total of EUR 900,000 for three serious breaches of the Spanish data protection law related to its handling of customers’ personal information. According to the AEPD, Google is illegally collecting and processing information from both registered and unregistered users, the latter referring to “passive users” that have not requested Google’s services but simply access websites that include elements managed by the company. The agency added that Google is collecting personal information via the nearly 100 services and products that it offers in Spain without providing adequate information on the data collected or the purpose of that data, and without obtaining users’ valid consent.

In early 2012 Google consolidated its 60 privacy policies into one and started combining data collected on individual users across its services, including YouTube, Gmail and social network Google+, while giving users no means to opt out.
The AEPD also accused Google of processing a "disproportionate" amount of data across its various services and holding onto it for an "undetermined or unjustified" period of time. "Google uses sophisticated technology that exceeds the ability of most users to take informed decisions about the use of their personal data so that, in practice, they lose control of their data," said the Agency, adding that it 2hampers, and in some cases, prevents users from exercising their rights of access, rectification, cancellation and opposition" with regard to the data.

The AEPD’s action follows a similar probe by France’s privacy watchdog (CNIL) that led to a warning of sanctions in September. The French, German, Italian, Spanish, Dutch, Italian and UK regulators have since worked together to investigate the company's practices, suggesting that Spain’s decision to fine Google could be repeated in other EU countries.