Privacy & Information Security Law Blog

On June 17, 2010, the French data protection authority (the “CNIL”) reported that it had conducted an on-site investigation at Google on May 19 to examine activities by Google’s Street View cars.  This investigation followed Google’s May 14 announcement that it had inadvertently captured Wi-Fi signals emitted in locations where its vehicles were taking photos.

Although the CNIL’s inspections are ongoing, preliminary findings reveal that Google collected passwords to users’ email inboxes as well as email content, and may have used this data for other services such as Google Maps and Google Latitude.  The report indicates that the CNIL is the first DPA in the world to obtain data collected by Google Street View, and that it appears Spanish and German authorities have made similar demands.

According to the CNIL, these findings confirm its conclusion that Google’s activities involving Latitude constitute a form of “processing” being carried out on French soil.  Accordingly, the CNIL reminded Google that it must comply with the French Data Protection Act by registering its data processing activities related to Google Latitude.  Google faces criminal sanctions if the CNIL’s investigation concludes that it collected personal data illegally.