CNIL imposes 50 million penalty over Google LLC

CNIL imposes 50 million penalty over Google LLC

The complaints against Google have been submitted to the French Data Protection Authority (CNIL) by the association None Of Your Business (“NOYB“) and La Quadrature du Net (“LQDN“). The associations criticized Google for not having a valid legal basis to process the personal data of the users of its services, in particular for the purpose of personalization of advertising.

The found deficiencies

The CNIL found out that the information provided by Google is not easily accessible for users. Essential information, such as the purposes for which the data is processed, for how long the data is stored or the categories of data used to personalize the advertisements, are excessively scattered throughout several documents and are only accessible by clicking on several buttons and links.

Also, the information delivered is not always clear and comprehensible for the users. The users were not able to understand the extent of the processing of Google. The information provided was not sufficiently clear for the data subjects to understand that the legal basis for the personalization of advertisement is the consent of the users and not the legitimate interest of Google.

Furthermore, the consent of the users was not validly obtained because the users have not been correctly informed and because the consent obtained was not specific and unambiguous. The users were not able to become aware of the variety of the services that are involved in this processing (e.g. YouTube, Google Maps, Google search, etc.). Giving the consent to the personalization of advertisement was also not unambiguous because the display of personalized ads is pre-checked by default. According to the GDPR, consent should be given by a clear affirmative act (e.g. tick an unchecked box).

The consent is not specific as well, because the users have to give their consent for more than one purpose pursued by Google at once. According to the GDPR, consent is only specific if it is given separately for each purpose.

Why the penalty turned out that high

Therefore, the French Data Protection Authority decided to condemn Google to a penalty of 50 million euros. The high fine results from the severity of the deficiencies, namely the violation of the principles relating to personal data processing.

Entscheidungsdatum:
21.01.2019

Land:
France

Art des Verstoßes:
violated duty to inform

Betroffene Datensätze:
unknown

Waren sensible Daten betroffen?:
No

verhängte Geldstrafe:
€ 50,000,000,-

Quelle: