The ICO is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals. The ICO has recently ordered Google to sign a formal undertaking to improve the information it provides to individuals about how it collects personal data in the UK.

It is well known that Google acquires vast amounts of personal data, and the ICO has found that the search engine has been too vague in its descriptions as to how it uses personal data gathered from its web services and products. As a result of the ICO’s investigation, Google has stated that it will now provide unambiguous and comprehensive information regarding data processing, including an exhaustive list of the types of data processed by Google and the purposes for which data is processed. Google’s commitments are consistent with the requirements of the UK Data Protection Act 1998 (DPA).

This undertaking enforced by the ICO marks a significant step forward following a lengthy investigation. Google’s commitment to making changes to its privacy policy will improve the information that UK consumers receive when using its online services and products. Overall, the ICO hopes that this decision will highlight to all online organisations the requirement to comply with data protection law. Ensuring that personal data is processed fairly and transparently is a key requirement of the DPA. The ICO hopes that the detailed agreement Google has signed setting out its commitments will encourage other organisations to follow suit.

The ICO has already worked with Google to ensure a significant number of changes to its policy. The search engine must now make the agreed further changes by 30 June 2015 and take additional steps over the next two years. The ICO plans to update its Privacy Notices Code Practice later in 2015 to provide organisations with further guidance about how to provide effective privacy information, particularly in online and mobile environments.