Google faces EU crackdown over privacy violations

January 2012's privacy policy comes under fire.

The EU is considering a "co-ordinated crackdown" on Google after it ignored requests from regulators to delay the imposition of its new privacy policy until they had cleared it for compliance with data protection law.

The policy was announced last January (though it only came into effect in March), and allowed Google to mix personal data from all its subsidiaries, particularly Youtube, which had hitherto been cordoned off. The new internal user profiles this enabled the company to create are of great value to advertisers, but the company also trumpeted the improved experience it could offer users, saying at the time:

Our privacy policies have always allowed us to combine information from different products with your account — effectively using your data to provide you with a better service. However, we’ve been restricted in our ability to combine your YouTube and search histories with other information in your account. Our new privacy policy gets rid of those inconsistencies so we can make more of your information available to you when using Google.

The EU didn't agree, and asked the company to hold off implementation until it had held an investigation on whether it complied with EU data protection law. The probe, which began in mid-March, finally reported back in October, and found that the new policy did indeed breach EU law. The French data protection commission, the CNIL, which led the investigation, had recommended a number of changes, such as easier opt-outs for advertising. But the company insists its policy already complies with EU law.

As a result, the CNIL is organising a co-ordinated response to Google, since, as the head of the commission told the Wall Street Journal on Monday, "we're better armed when we speak with one voice than when each country takes its own steps".

The EU hasn't played the situation brilliantly. The fact that its investigation only reported back in October, over six months after it began, is proof of severe regulatory overreach; and it would have been an unnecessary and unsupportable restraint on Google to have asked it to hold off on what was a major business decision for that entire period.

Nonetheless, Google appears to be continuing a trend amongst Silicon Valley — exemplified by Facebook in its squabble with the Irish data protection commission over facial recognition data — of assuming that the regulations of the countries it operates in don't apply to it. The EU has considerably stricter data protection laws than the US, and while some of them, such as the ill-fated cookie directive, are worthy of being ignored, others provide genuine protection for the consumer.

Google maintains that "we have engaged fully with the CNIL throughout this process and will continue to do so," but the EU's privacy group will vote on whether to take action against the company at the end of February.

Photograph: Getty Images

Alex Hern is a technology reporter for the Guardian. He was formerly staff writer at the New Statesman. You should follow Alex on Twitter.

Photo: Getty
Show Hide image

The Prevent strategy needs a rethink, not a rebrand

A bad policy by any other name is still a bad policy.

Yesterday the Home Affairs Select Committee published its report on radicalization in the UK. While the focus of the coverage has been on its claim that social media companies like Facebook, Twitter and YouTube are “consciously failing” to combat the promotion of terrorism and extremism, it also reported on Prevent. The report rightly engages with criticism of Prevent, acknowledging how it has affected the Muslim community and calling for it to become more transparent:

“The concerns about Prevent amongst the communities most affected by it must be addressed. Otherwise it will continue to be viewed with suspicion by many, and by some as “toxic”… The government must be more transparent about what it is doing on the Prevent strategy, including by publicising its engagement activities, and providing updates on outcomes, through an easily accessible online portal.”

While this acknowledgement is good news, it is hard to see how real change will occur. As I have written previously, as Prevent has become more entrenched in British society, it has also become more secretive. For example, in August 2013, I lodged FOI requests to designated Prevent priority areas, asking for the most up-to-date Prevent funding information, including what projects received funding and details of any project engaging specifically with far-right extremism. I lodged almost identical requests between 2008 and 2009, all of which were successful. All but one of the 2013 requests were denied.

This denial is significant. Before the 2011 review, the Prevent strategy distributed money to help local authorities fight violent extremism and in doing so identified priority areas based solely on demographics. Any local authority with a Muslim population of at least five per cent was automatically given Prevent funding. The 2011 review pledged to end this. It further promised to expand Prevent to include far-right extremism and stop its use in community cohesion projects. Through these FOI requests I was trying to find out whether or not the 2011 pledges had been met. But with the blanket denial of information, I was left in the dark.

It is telling that the report’s concerns with Prevent are not new and have in fact been highlighted in several reports by the same Home Affairs Select Committee, as well as numerous reports by NGOs. But nothing has changed. In fact, the only change proposed by the report is to give Prevent a new name: Engage. But the problem was never the name. Prevent relies on the premise that terrorism and extremism are inherently connected with Islam, and until this is changed, it will continue to be at best counter-productive, and at worst, deeply discriminatory.

In his evidence to the committee, David Anderson, the independent ombudsman of terrorism legislation, has called for an independent review of the Prevent strategy. This would be a start. However, more is required. What is needed is a radical new approach to counter-terrorism and counter-extremism, one that targets all forms of extremism and that does not stigmatise or stereotype those affected.

Such an approach has been pioneered in the Danish town of Aarhus. Faced with increased numbers of youngsters leaving Aarhus for Syria, police officers made it clear that those who had travelled to Syria were welcome to come home, where they would receive help with going back to school, finding a place to live and whatever else was necessary for them to find their way back to Danish society.  Known as the ‘Aarhus model’, this approach focuses on inclusion, mentorship and non-criminalisation. It is the opposite of Prevent, which has from its very start framed British Muslims as a particularly deviant suspect community.

We need to change the narrative of counter-terrorism in the UK, but a narrative is not changed by a new title. Just as a rose by any other name would smell as sweet, a bad policy by any other name is still a bad policy. While the Home Affairs Select Committee concern about Prevent is welcomed, real action is needed. This will involve actually engaging with the Muslim community, listening to their concerns and not dismissing them as misunderstandings. It will require serious investigation of the damages caused by new Prevent statutory duty, something which the report does acknowledge as a concern.  Finally, real action on Prevent in particular, but extremism in general, will require developing a wide-ranging counter-extremism strategy that directly engages with far-right extremism. This has been notably absent from today’s report, even though far-right extremism is on the rise. After all, far-right extremists make up half of all counter-radicalization referrals in Yorkshire, and 30 per cent of the caseload in the east Midlands.

It will also require changing the way we think about those who are radicalized. The Aarhus model proves that such a change is possible. Radicalization is indeed a real problem, one imagines it will be even more so considering the country’s flagship counter-radicalization strategy remains problematic and ineffective. In the end, Prevent may be renamed a thousand times, but unless real effort is put in actually changing the strategy, it will remain toxic. 

Dr Maria Norris works at London School of Economics and Political Science. She tweets as @MariaWNorris.