CNIL imposes 50 million fine on Google

CNIL imposes 50 million fine on Google

The complaints against Google were filed with the French data protection authority (CNIL) by the NOYB (None Of Your Business) association and the LQDN (La Quadrature du Net). Both criticized Google for not having a valid legal basis for processing personal data, especially for the purpose of personalizing advertising.

The defects found

CNIL found that the information provided was not easily accessible to users. Essential information, such as the purposes for which the data are processed, the duration for which the data are stored, and the categories of data used to personalize the advertising, are scattered across several documents and are only accessible via several links and buttons.

Likewise, the information is not always clear and understandable for the user. The scope of Google’s processing was also not comprehensible to users. The information provided is not clear enough for users to understand that the legal basis for advertising personalization is user consent and not Google’s legitimate interest.

In addition, the consent of the users was not effectively obtained because they were not properly informed about it and the consent was not specific and unambiguous. It was not possible for users to identify the variety of services involved in this processing (e.g. Youtube, Google Maps, Google Search, etc.). Consent to personalized advertising is also ambiguous because it is allowed as a default setting. According to the GDPR, the user must take a positive action to agree to consent (e.g., check a box).

Consent is also not specific because users give only one common consent for all processing operations. However, according to the GDPR, the user must give consent for each processing individually for it to be legally effective.

Why the penalty was so high

The French data protection authority therefore decided to fine Google 50 million euros. The high fine resulted from the seriousness of the identified deficiencies, namely the violation of the principles for the processing of personal data.

Update: Google has appealed the penalty.

Entscheidungsdatum:
21.01.2019

Land:
France

Art des Verstoßes:
violated duty to inform

Betroffene Datensätze:
unknown

Waren sensible Daten betroffen?:
No

verhängte Geldstrafe:
€ 50,000,000,-

Quelle:
Press release of the French data protection authority CNIL (English)