This article was published in 2019. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
The French privacy watchdog CNIL has imposed a fine of 50 million euros on Google. This is evident from CNIL’s fining decision. According to CNIL, Google does not adequately inform its users about, among other things, what information it stores about them. This data is also too difficult to access. As a result, users find it hard to find out what personal data Google keeps about them, the French privacy watchdog states.
CNIL announced this on Monday. It is the first fine France has imposed under the General Data Protection Regulation (GDPR).
Google told the press agency AFP that it will study the French watchdog’s decision. Google is still considering possible further steps. The spokesperson: “People expect high standards of transparency and control from us”. The spokesperson continues: “We take those expectations and the requirements of the GDPR very seriously.”
Essential information too widely scattered
The case was brought by two French organisations that stand up for privacy. 12,000 people had backed the complaint. According to CNIL, Google is breaching the law on several fronts. “Essential information (…) is excessively disseminated across several documents”, the watchdog writes in a press release. This concerns why and for how long data of the search engine’s users is stored, and how Google uses it for personalised advertising. According to CNIL, people who want to view this information sometimes have to click five or six times. In addition, Google is said to describe too vaguely and too generally what exactly it stores. This is the main reason the two organisations filed a complaint against Google.
GDPR makes hefty fines possible
Under the GDPR, authorities can impose fines on companies of up to 4 percent of turnover. The Dutch Data Protection Authority is the competent privacy regulator in the Netherlands.
The legislation is intended to give users more control over and protection of what happens to their data. Alphabet, Google’s parent company, had a turnover of 111 billion dollars in 2017, almost 100 billion euros. It can still challenge the fine before France’s highest administrative court.
Privacy is a major challenge for tech companies
As early as 2018, when the GDPR came into force, NRC Handelsblad wrote that privacy is a major challenge for large tech companies. According to the European consumer organisation, the privacy policies of Facebook, Google and Amazon, among others, did not at that time comply with the GDPR.
The privacy policies of fourteen large tech companies, including Facebook, Google and Amazon, do not yet meet the requirements of the new GDPR privacy legislation. That was the conclusion of the European consumer organisation BEUC following an analysis of the terms of use of the fourteen large companies. According to BEUC, the companies need to improve their privacy policies.