Italy to Google: You have 18 months to comply with European privacy laws

Italy’s data regulator is cracking down on Google, the organization said Tuesday in a statement. The country’s Data Protection Authority says Google has 18 months to change the way it handles and stores user data.

The Italian inquiry follows an large scale investigation across Europe into whether the search giant violates privacy policies in Europe. Data protection agencies in Britain, Germany, Spain, and the Netherlands are also conducting reviews of Google’s practices. Most notable has been the E.U.’s ‘right to be forgotten’ court ruling in May.

[aditude-amp id="flyingcarpet" targeting='{"env":"staging","page_type":"article","post_id":1511354,"post_type":"story","post_chan":"none","tags":null,"ai":false,"category":"none","all_categories":"business,","session":"D"}']

The ruling said that individuals have a right to ask search engines to take down links to personal information about them if the information is excessive, irrelevant, or inaccurate. The E.U. says requests should be considered on a case by case basis, although there has been a wave of link removals to articles involving prominent figures — like former Merrill Lynch CEO Stan O’Neal. It’s uncertain how much room Google has to refuse link removal requests.

Google has already consolidated all policies concerning data privacy for its various outlets like YouTube, Google Plus, and Google Analytics into a single overarching disclosure that outlines what the company does with user data. But after a review of Google’s practices, Italy’s privacy watchdog says that’s not enough. The agency is now saying Google must present a strategic plan for compliance with Italy’s privacy regulations by September.

Italian regulations require Google to be more specific in its disclosure about how personal data is stored and used — ie. profiling users for targeted advertising. In addition to detailing how user profile data will be used, Google must fulfill requests for content to be removed from web searches within two months of a request, though it will have up to six months from the request date to delete data from its back-up systems.

So far, Europe’s new right-to-be-forgotten regulation has seen some some requests for deletion dangling awfully close to freedom of speech and press law infringement. There’s no doubt that Europe is stumbling through this process, but the laws that come out of these investigations will serve as a model for the U.S., if not the rest of the world.