The investigation has been led by French watchdog CNIL, which today said Google had failed to meet a deadline to comply with France’s data protection law.
The regulator now intends to proceed with “initiating a formal procedure for imposing sanctions”.
“On 20 June 2013, the CNIL’s chair had ordered Google to comply with the French data protection law within three months. On the last day of this period, Google responded to the CNIL. Google contests the reasoning of the CNIL and has not complied with the requests laid down in the enforcement notice,” said a statement from CNIL.
The regulator stipulated a number of areas where it required Google to demonstrate compliance with data protection laws:
- Define specified and explicit purposes for its policy
- Inform users about the purposes of the processing implemented
- Define retention periods for personal data processed
- Not proceed, without legal basis, with the potentially unlimited combination of users’ data
- Fairly collect and process passive users’ data
- Inform users and then obtain their consent before dropping cookies
Google has maintained all along that its privacy practices respect European laws.