In Italy, the Data Protection Agency this week ruled that Google must now gain explicit permission from Italian users before creating a profile about them. Separately, a U.S. district court judge ruled that a class action privacy lawsuit against Google filed by users of devices running the Android operating system can proceed, despite Google's attempt to have the suit thrown out.
Google now has 18 months to comply with the ruling, and must provide a roadmap to the Data Protection Agency by the end of September.
EU Investigations Ongoing
The Italian DPA ruling follows the agency slapping Google with a 1 million euros ($1.4 million) fine in April over its Street View program violating Italian data protection rules, by capturing and publishing recognizable images of people. That followed similar - although less costly - fines in Spain and France. Legal experts say Google could still face further Street View fines in Italy over its sniffing of unencrypted Wi-Fi communications.
Balancing Privacy, Business
But Italy isn't singling out Google or applying undo pressure, experts say. "On the contrary ... the present resolution, although it is very prescriptive and mandatory, at the same time does not impose any sanctions," Panetta says of this week's DPA ruling. Instead, it highlights that Google has been breaking Italian law via its lack of notice and consent for its profiling activities, and requires related changes.
The ruling won't just apply to Google. "I would expect that negotiations will start soon on how to find solutions also for other businesses relying on big data and behavioral advertising," says DLA Piper's Coraggio. "However, pending such negotiations, the risk is that the Italian DPA will start sanctioning operators that do not provide adequate information to users and obtain their prior consent to the profiling of their data for marketing purposes."
U.S. Lawsuit Advances
Google recently moved to dismiss the lawsuit entirely, but failed to secure a decisive victory, with U.S. District Court Magistrate Judge Paul Singh Grewal issuing a 28-page decision July 21 that allows parts of the case to proceed.
"Like Rocky rising from Apollo's uppercut in the 14th round, plaintiffs' complaint has sustained much damage but just manages to stand," Grewal writes. "The court grants the motion, but only in part."
A Google spokesman didn't respond to a request for comment on the judge's decision.