The ICO is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals. The ICO has recently ordered Google to sign a formal undertaking to improve the information it provides to individuals about how it collects personal data in the UK.
It is well known that Google acquires vast amounts of personal data, and the ICO has found that the search engine has been too vague in its descriptions as to how it uses personal data gathered from its web services and products. As a result of the ICO’s investigation, Google has stated that it will now provide unambiguous and comprehensive information regarding data processing, including an exhaustive list of the types of data processed by Google and the purposes for which data is processed. Google’s commitments are consistent with the requirements of the UK Data Protection Act 1998 (DPA).
The ICO has already worked with Google to ensure a significant number of changes to its policy. The search engine must now make the agreed further changes by 30 June 2015 and take additional steps over the next two years. The ICO plans to update its Privacy Notices Code Practice later in 2015 to provide organisations with further guidance about how to provide effective privacy information, particularly in online and mobile environments.