Many of "the elements provided do not give a precise, clear and comprehensive response to our questions," said CNIL President Isabelle Falque-Pierrotin. "Many answers merely provide illustrative examples without describing the exact processings, procedures or systems Google actually operates."
On Wednesday the CNIL submitted an extensive list of rephrased questions to Google that clarify the regulatory body's expectations concerning the nature of the information that it expects to receive by no later than June 8.
"The fact that Google's position on personal data proceedings is still unclear on many points after an in-depth exchange with the CNIL raises concerns," Falque-Pierrotin wrote in a letter to Google CEO Larry Page.
Lacking Basic Information
Among other things, the CNIL wants to know how many times Internet users actually viewed Google's new privacy Web site from the last week of January through March 1st this year. And for comparison purposes, regulators also want Google to indicate the total number of Google services users.
The CNIL noted that Google has not yet delivered a complete list of its personal data processings, as defined by the European Data Protection Directive. Regulators also want to receive the complete list of the privacy policies that Google has merged into the new single policy for all of its Web properties.
Personal Data Processing Questions
The CNIL's immediate goal is to completely understand just how Google processes personal data. Moreover, the regulatory body wants to obtain a clearer view of the links that exist between the personal data Google collects and the purposes for which the user's personal data is applied, as well as the personal data's recipients.
"Regarding the combination of data across services, the CNIL reiterates its concerns about the purposes and the breadth of these combinations as well as their legal basis," the regulatory body said. "The CNIL would also like to clarify the actual effects of Google's opt-out mechanisms and their validity as a means to exercise the right to oppose."
Additionally, European regulators noted that Google still needs to explain how it is applying the European Union's ePrivacy Directive to so-called passive Google users. These are the individual Web surfers who use Google's services while visiting third-party Web sites.