A recent administrative order was issued for Google to “to take the necessary technical and organisational measures to guarantee that their users can decide on their own if and to what extend their data is used for profiling.” Last week the Hamburg Commissioner of Data Protection and Freedom of Information (HmbBfDI) ordered that Google is “compelled to collect and combine user data only in accordance with the existing legal framework.”

The HmbBfDI made the following complaint about Google’s privacy policy:

…Google excludes the association of especially sensitive data with other usage data for the purpose of presenting users tailored ads. Nevertheless the combination of all the collected data form the different single services used allows the creation of meaningful and nearly and comprehensive personal records.

The HmbBfDI cited as examples that Google content and usage date collected the following data about individuals:

  • to compile detailed travel profiles by evaluating location data,
  • to detect specific interests and preferences by evaluating search engine use,
  • to assess the user’s social and financial status, their whereabouts and many other of their habits by analysing the collected data and
  • to infer information such as friend relationships, sexual orientation and relationship status.

The Washington Post made the following observation:

That administrative order is bringing to a head the question of whether U.S.-born, ad-driven Web services like Gmail, YouTube and Facebook can peacefully co-exist with a Europe that is enormously sensitive about possible incursions on personal privacy.

Many countries in the EU have been highly critical since 2012 when Google changed its Privacy Policy and no doubt these types of orders will continue to be issued in the EU.