The Italian Data Protection Authority (DPA), the Garante, has issued a prescriptive rule to Google. The procedure was opened by the Garante fter Google's changes to its privacy policy last year.

This is the first measure of this kind in Europe, and it is a result of a coordinated action with other European DPAs and follows the judgment of the European Court of Justice on the right to be forgotten. By means of the provision, issued on July 10, the Garante indicates the measures that Google should take in order to ensure the full compliance with the applicable law and EU directive. 

In particular:

•  The Garante prescribes the adoption of an informative notice structured on several levels, so as to provide, at a first, the most relevant information for the user about the processing of personal data. At a second level, Google shall describe more detailed and specific information about each service. Moreover, the informative notice should explain clearly that the personal data are used for profiling purposes in order to ensure advertising tailored around the interests of each user.

• The profiling and behavioral advertising should be allowed only if Google has obtained the prior and express consent for such purposes. To this extent, it cannot be acceptable to consider the simple use of each service as an unconditional acceptance of the terms contained in the informative notice. The Garante also indicated an innovative way that should not overburden the user’s navigation.

• Google will have to redefine the timing of data retention on the basis of the provisions contained in the Privacy Code. With regard to the cancellation of personal data, the Garante stated that requests from users that have an account must be fulfilled, at least, within two months in cases where they are stored on the “active” systems. When the data are stored on back-up systems, the timing increases up to six months.

 Google will have now 18 months to comply with the requirements of the Garante. During this time, the DPA will monitor adoption of the measures prescribed.

After the Google victory in the Google Italia case by the Italian Supreme Court, the condemnation to $1 million euros by the Garante for the Google Street View service and the ECJ sentence on the right to be forgotten, this is the forth important rule affecting the Big G in EU.