CNIL imposes 50 million penalty over Google LLC
The complaints against Google have been submitted to the French Data Protection Authority (CNIL) by the association None Of Your Business (“NOYB“) and La Quadrature du Net (“LQDN“). The associations criticized Google for not having a valid legal basis to process the personal data of the users of its services, in particular for the purpose of personalization of advertising.
The found deficiencies
The CNIL found out that the information provided by Google is not easily accessible for users. Essential information, such as the purposes for which the data is processed, for how long the data is stored or the categories of data used to personalize the advertisements, are excessively scattered throughout several documents and are only accessible by clicking on several buttons and links.
Also, the information delivered is not always clear and comprehensible for the users. The users were not able to understand the extent of the processing of Google. The information provided was not sufficiently clear for the data subjects to understand that the legal basis for the personalization of advertisement is the consent of the users and not the legitimate interest of Google.
Furthermore, the consent of the users was not validly obtained because the users have not been correctly informed and because the consent obtained was not specific and unambiguous. The users were not able to become aware of the variety of the services that are involved in this processing (e.g. YouTube, Google Maps, Google search, etc.). Giving the consent to the personalization of advertisement was also not unambiguous because the display of personalized ads is pre-checked by default. According to the GDPR, consent should be given by a clear affirmative act (e.g. tick an unchecked box).
The consent is not specific as well, because the users have to give their consent for more than one purpose pursued by Google at once. According to the GDPR, consent is only specific if it is given separately for each purpose.
Why the penalty turned out that high
Therefore, the French Data Protection Authority decided to condemn Google to a penalty of 50 million euros. The high fine results from the severity of the deficiencies, namely the violation of the principles relating to personal data processing.
Type of Issue:
violated duty to inform
Number of involved data records:
Special category of data involved:
Violation of GDPR Paragraph:
12. Transparent information, communication and modalities for the exercise of the rights of the data subject
13. Information to be provided where personal data are collected from the data subject
14. Information to be provided where personal data have not been obtained from the data subject
21. Right to object
25. Data protection by design and by default
31. Cooperation with the supervisory authority
5. Principles relating to personal data processing
6. Lawfulness of processing
7. Conditions for consent
83. General conditions for imposing administrative fines