France, Spain ponder fining Google on privacy violation in PRISM fallout

France and Spain have led a Europe-wide push to get Google to change its policies on collecting user data after it was revealed that the company was part of the US National Security Agency’s surveillance program, PRISM.

Whistleblower, Edward Snowden, has told the media that the NSA secretly gathers user data from nine American companies, including Google, to track people's movements, contacts and activities.

French data protection watchdog (CNIL) said that Google had broken the country’s law, giving the US internet giant three months to change its privacy policies or risk a fine of up to 150,000 euros.

"There is a mass of personal information floating about on people in the Google galaxy that people are not even aware of," Falque-Pierrotin, CNIL President, told Reuters. "All we are saying to Google is that we would like it to lift the veil a little on what it's doing."

France’s main concern is the way Google combines anonymous data from users' browsing histories across its services to better target advertising.

Spanish Data Protection Agency (AEPD), in its turn, plans to fine Google between 40,000 euros and 300,000 for five violations of the law when it failed to be clear about what it did with data.

Spain believes the company may be processing a "disproportionate" amount of data and holding onto it for an "undetermined or unjustified" period of time.

The French CNIL, which has been on the forefront of European inquiry since Google launched its consolidated privacy policy in last year, said UK, Germany, Italy and the Netherlands would be taking similar action against Google.

"By the end of July, all the authorities within the (EU data protection) task force will have taken coercive action against Google," Isabelle Falque-Pierrotin said.

Britain is still deciding whether the web giant has broken its law and says it’ll soon inform the company on its ruling.   

Next week, Google is also due to answer allegations on privacy issue during a hearing in a German court.

Meanwhile, the company says it’ll continue cooperating with the authorities in France and other European countries.

"Our privacy policy respects European law and allows us to create simpler, more effective services. We have engaged fully with the authorities involved throughout this process, and we'll continue to do so going forward," a Google’s spokesman said by email.

In March 2012, Google unified its 60 privacy policies into one and started combining data collected on individual users across its services, including YouTube, Gmail and Google+ social network, while giving the users no means to opt out.

CNIL’s main concern is that Google may be combining users’ combined browsing histories from such profiles to better target advertising.

The move pushed national data protection regulators across Europe to begin a joint inquiry into the matter. Penalties cannot be introduced EU-wide and are done country by country.