[WG-P3] France - CNIL heads EU showdown with Google & Other Bits & Picies

[Mark Lizar]

Some Grist for the Assessment Mill.

In regards, to assessments for Privacy, a couple of articles since the last meeting illustrate the need for notice in the management of identity and profiles.   Notification being a common requirement for privacy across all jurisdictions, it is the first place to look to asses what jurisdictional requirements exist.

What is interesting to see, is if Google is going to be held accountable by CNIL, for not providing sufficient notice to its users with its privacy policy changes.  In the EU I would not be surprised if Google will be required for consent to combine user profiles across different products.  Especially since their privacy changes are retro-active and provide US gov with easier, more comprehensive access to its user profiles, without a warrant. (according to Patriot Act Jan 2012 - see below)  -- An issue that concerns many inside and outside the USA, as flagged up by the ABA.

It is clear that notification is the tip of the iceburg for assessing accountability across data management practices.   

- Best Regards,

Mark

Begin forwarded message:

France heads EU showdown with Google
http://www.smartplanet.com/blog/global-observer/france-heads-eu-showdown-with-google/4655

The EU, however, in a letter dated February 27, told Google that the new
privacy policy does not comply with the European Directive on Data
Protection.  In addition to giving, in some cases, only a few hours of
notice before going public with the new measures, Google did not
sufficiently debrief the European authorities, according to the letter.

The larger issue, however, is the obscurity of the new policy and
uncertainty about how the information collected will be used.  French state
advisor and CNIL president Isabelle Falque-Pierrotin wrote in the letter
that more information is needed about how Google will exploit user data
since there are many varied services being grouped under one privacy policy.
"It is impossible for average users who read the new policy to distinguish
which purposes, collected data, recipients or access rights are currently
relevant to their use of a particular Google service," she wrote.

<snip> from 

New Google privacy policy has law-enforcement holes, say experts
http://www.technolog.msnbc.msn.com/technology/technolog/new-google-privacy-policy-has-law-enforcement-holes-say-experts-277522

Google's united privacy policy follows a radical expansion of the Patriot
Act in January, giving FBI the power to access customer service records from
Internet service providers, as well as financial institutions and credit
companies, no court order required.

<snip>

American Bar Association asks courts to consider foreign privacy laws
http://www.lexology.com/library/detail.aspx?g=90c3fdef-b864-4611-9304-d344c81e3781

  "RESOLVED, That the American Bar Association urges that,
  where possible in the context of the proceedings before them,
  U.S. federal, state, territorial, tribal and local courts consider
  and respect, as appropriate, the data protection and privacy
  laws of any applicable foreign sovereign, and the interests of
  any person who is subject to or benefits from such laws, with
  regard to data sought in discovery in civil litigation."