On March 1, 2012, Google will replace its existing privacy policy with an entirely new policy, which will apply to most Google products, including the Google search engine, Gmail and YouTube, and consolidate over 60 different existing privacy policies for various Google products and services.
Pursuant to the new privacy policy, if an account-holder is signed in to a Google product, Google will combine the information that the individual has provided from one service with the information from its other services, such that the account-holder is treated as one single user across all Google products. For example, if a user spends an hour researching hockey on the Google search engine, the next time that user logs into YouTube, he or she might get recommendations for hockey videos, along with advertising for hockey gear or sporting events.
The new privacy policy has been highly criticized by some commentators since Google disclosed its plan in late January 2012, perhaps unfairly. To better address many of the concerns and arguments relating to the new Google privacy policy, we have set out several considerations below.
A recent decision by the Office of the Privacy Commissioner of Canada (OPC) reminds multi-national companies that carry on business in Canada that compliance with foreign data protection legislation may not be sufficient in protecting them from the scope of Canadian privacy legislation.
In its Report of Findings #2011-002, the OPC considered two complaints lodged under the Personal Information Protection and Electronic Documents Act (PIPEDA) with respect to KLM Royal Dutch Airlines, a Netherlands-based company, and its failure to adhere to Canadian standards of openness, transparency, and access to information. In particular, the complainant alleged that KLM had denied him access to his personal information and to that of his family members, and that KLM had failed to provide the complainant with information about its policies and practices relating to the management of his personal information, contrary to its obligations under PIPEDA.