Janene Van Jaarsveldt reports:
Google’s not totally out of the woods yet, though. Read more on NL Times.
A statement on the Dutch Data Protection Authority site explains:
The results of the investigation by the Dutch DPA, which were published earlier, showed that Google combines personal data of internet users, to, amongst others, display personal ads. This combining occurred without Google adequately informing the users in advance and without the company asking for their consent. This is in violation of the law.
The practice of combining personal data does not only involve people that are logged in to a Google account, but also people that use Google’s search engine, or visit a (third party) website that places or reads cookies from Google. Data about for example search queries, location data, video’s watched and e-mails sent and received can be combined with each other, while those services serve very different purposes.
During a legal procedure started by Google, appealing against the incremental penalty payment imposed, the Dutch DPA partly revoked the imposed incremental penalty payment for the remaining infringement by extending the deadline within which Google has to obtain unambiguous consent of all of its users to the end of December.
This means that all users of Google services must have had the opportunity to give their unambiguous consent for the combining of their personal data not later than by the end of December 2015.
If Google does not properly obtain consent, the company risks a penalty payment of 5 million euros. For the moment, Google does not need to make any penalty payments.