Google reported to UK Information Commissioner over Gmail

Announced last week, the service incorporates targeted ads into incoming e-mail, following a computer scan of the message content.

"This is not just 'buyer beware,'" Simon Davies, director of Privacy International, told Reuters. "Consumers should be aware that there's a vast violation of European law occurring here."

The group is among 28 privacy and civil liberties organisations that today sent an open letter to Google founders Sergey Brin and Larry Page, urging them to suspend the Gmail plans "until the privacy issues are adequately addressed."

The letter also calls upon Google to clarify its written information policies regarding data retention and data sharing among its business units.

The 28 organisations voiced concerns about Google's plan to automatically scan the text of all incoming messages for the purposes of ad placement. They argue that the scanning of confidential e-mail for inserting third party ad content "violates the implicit trust of an e-mail service provider," that the scanning "creates lower expectations of privacy in the e-mail medium," and that it "may establish dangerous precedents."

Other concerns include the unlimited period for data retention that Google's current policies allow, and the potential for unintended secondary uses of the information Gmail will collect and store.

Their concern that Gmail breaches the European Data Protection Directive is based on consent. The Directive states that users' consent must be informed, specific, and unambiguous. As it has been proposed, and based on the current Gmail privacy policy, the letter says the consent of EU-based Gmail users "cannot necessarily be considered informed, specific, and unambiguous in regards to the scanning, storage and further processing of their e-mails."

The letter says the need for informed, specific, and unambiguous consent also applies to the potential linking of EU citizens' e-mails to their search histories. It further speculates that additional issues with data retention may also exist under the EU Privacy Directive.