The CNIL welcomes Google's collaboration but regrets that the answers are often incomplete or approximate. In order to finalise its analysis on this new policy, the CNIL sent an additional questionnaire on 22 May to clarify some questions. Additionally, a meeting between the CNIL and Google's representatives was held at the Commission on 23 May. The CNIL gave Google until 8 June to answer.
As such, the CNIL considers it impossible to know Google's processings of personal data, as well as the links between collected data, purposes and recipients, and that the obligation of information of the data subjects is not respected. The CNIL also notes that Google has not provided a maximum retention period for the data.
Regarding the combination of data across services, the CNIL reiterates its concerns about the purposes and the breadth of these combinations as well as their legal basis. The CNIL would also like to clarify the actual effects of Google's opt-out mechanisms and their validity as a means to exercise the right to oppose.
Finally, Google has not provided a practical answer on the way the ePrivacy Directive is applied for Google's “passive users”, i.e. the persons who use Google's services (advertising, analytics, +1 button) when they visit third-party websites.
Once complete and detailed answers will have been provided, the CNIL will present its report to the Article 29 Working Party, who will define its position and the potential improvements Google should bring to this policy to comply with the European data protection framework. The conclusions of the analysis will be sent to Google before mid-July.