Google to change UK privacy policy after regulatory pressure

The company has signed an undertaking committing to make further changes to the privacy policy to ensure it meets the requirements of the U.K.'s Data Protection Act, the Information Commissioner's Office (ICO) said Friday. Google will also take steps to ensure that future changes to its privacy policy comply with the law.

Google changed its privacy policy in March 2012, combining around 70 existing policies for various services, despite the concerns of European Union data protection authorities.

Like other authorities, ICO found that Google was "too vague" when describing how it uses personal data gathered from its web services and products. It ruled that he new policy provided insufficient information for users as to how and why their personal data was being collected.

By June 30, Google will make changes to comply with ICO's demands. While it will provide more and clearer information, it will also provide a user resource covering data processed by Google and the purposes of processing the data, according to the document signed by Google's senior vice-president and general counsel, Kent Walker.

What's more, Google will redesign its Account Settings pages, allowing users to find a variety of controls and information more easily, while it will also provide information to enable individuals to exercise their rights. More information will be added too about the entities that may collect anonymous identifiers on Google properties and the purposes to which they put that data, according to the document.

Google did not immediately respond to a request for comment.

While the investigation concluded that there was "no substantial damage and distress to consumers" due to the policy change, it is still important for organisations to properly understand the impact of their actions and the requirement to comply with data protection law, ICO said.

"It is vital that there is clear and effective information available to enable users to understand the implications of their data being combined," it said, adding that Google had already made a significant number of changes.

In January last year, the French privacy regulator fined Google €150,000 (over US$170,000) for breaching data protection law with its new policy. Google later appealed that decision.

Spain's data protection authority fined Google €900,000 in December 2013 for not providing users enough information about the personal information it collects, and the purposes it uses it for.

And more recently, the Dutch privacy authority threatened fines of up to €15 million if it does not changes its privacy policy to start complying with Dutch law by the end of February.

Loek is Amsterdam Correspondent and covers online privacy, intellectual property, online payment issues as well as EU technology policy and regulation for the IDG News Service. Follow him on Twitter at @loekessers or email tips and comments to loek_essers@idg.com