This article was published in 2020. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
Google has lost its appeal against a French GDPR fine of 50 million euros. In 2019, the French privacy regulator CNIL imposed a fine of 50 million euros on Google for breaching the privacy rules of the General Data Protection Regulation (GDPR). The search engine giant appealed against this fine. The fine was rightly imposed, according to the French Council of State in a recent ruling.
What was the case about?
According to CNIL, Google does not adequately inform its users about, among other things, which information it stores about them. This data is also too difficult to access. As a result, users find it hard to discover which personal data Google keeps about them, the French privacy watchdog stated.
According to CNIL, the process by which Google asks for consent is “excessively spread out” over several pages. Users also have to click on buttons and links too often to be properly informed. This is contrary to the European privacy rules, which in the Netherlands are known as the AVG (the Dutch name for the General Data Protection Regulation).
The case was brought by two French organisations that campaign for privacy. 12,000 people had backed the complaint. According to CNIL, Google breaches the law in several respects. “Essential information (…) is too widely spread across different documents”, the watchdog writes in a press release.
This concerns why and for how long the data of the search engine’s users is stored, and how Google uses it for personalised advertising. According to CNIL, people who want to view this information sometimes have to click five or six times. Moreover, Google allegedly describes too vaguely and too generally what exactly it stores. This is the main reason why the two organisations filed a complaint against Google.
Google gets it completely wrong
According to CNIL, Google falls short in providing information about the processing and storage of data for targeted advertising. The same applies to obtaining valid consent. CNIL on this point: “Essential information, such as the purpose of the data processing, the data retention period and the types of personal data used for personalised advertising, is excessively spread across different documents, with buttons and links that must be clicked to obtain additional information. The relevant information is only accessible after several steps, sometimes requiring five to six actions.”
In addition, the internet giant claims to have a legal basis for processing data for targeted advertising. The French privacy regulator on this point: “Google states that it obtains users’ consent for the processing of data for personalised advertising. However, this consent is not valid for two reasons.” The first reason is that users are not sufficiently informed by Google. For example, the information about the data processing is spread across different documents. This means that the user is unable to grasp the extent of the data processing. CNIL also states that the consent collected is neither “specific” nor “unambiguous”.
The French privacy watchdog goes on to discuss Google’s working methods. When an account is created, the user can adjust various options for the account. However, it is not possible to configure the display of personalised advertisements on the first screen. Moreover, the display of personalised advertisements is selected by default in the more extensive options. Furthermore, when creating an account, a user must give consent for all data processing by Google. This is not specific. Google is therefore in breach of the GDPR, according to CNIL.
First high GDPR fine against Big Tech
This is the first time that CNIL has used the new fining power under the GDPR. According to CNIL, the amount was justified by the seriousness of the breach of the GDPR. The French Council of State also confirms that the amount of the fine is proportionate, given the seriousness of the breaches. This legislation is intended to give users more control and protection over what happens to their data.
The fine for Google is the highest imposed in Europe under the GDPR to date. Under the GDPR, authorities can impose fines on companies of up to 4 per cent of turnover. With a strict application of the GDPR, Google would receive a fine of 6.44 billion euros. However, the amount bears no relation to the turnover of Alphabet, which exceeded 161 billion dollars last year.
Prevent fines
Google has therefore lost its appeal against the French GDPR fine of 50 million euros. Prevention is better than cure, especially when fines can make a hole in your finances. We would be happy to work with you to shape your privacy management. This saves you financial setbacks, reputational damage and loss of data. Feel free to contact us today.