Blog » 50 MILLION EURO GIGA GDPR-FINE FOR GOOGLE – SURE WE HAVE A COMMENT!
50 MILLION EURO GIGA GDPR-FINE FOR GOOGLE – SURE WE HAVE A COMMENT!
06 February 2019
During the preparation of the GDPR, it was often pointed out in professional circles that Google and Facebook are the primary targets of the strictest data protection regime of the world. Well, a little more than half a year after the GDPR entered into force, the sword of the French data protection authority has hit Google. Let’s see why the authority awarded the tech-giant with a modest fine of 50 Million Euros?
1. Why did the authority initiate the investigation?
The first day of the applicability of the GDPR has just come and the representative associations None Of Your Business and La Quadrature de Net have gone straight to the French data protection authority (CNIL) to make complaints against Google.
The two associations collected the complaints of almost 10.000 data subjects and objected to Google’s data processing and data protection practices on similar grounds.
The major problem of the associations was that Google does not have a valid legal basis for processing personal data, especially when it comes to the data processing for ads personalization purposes. The complaint of the None Of Your Business concerned mainly the data processing in relation with the usage of the Android operation system.
2. Why did the French authority act?
The fact that the representative associations filed the complaints with the CNIL, did not make it fully clear that the French authority shall make the investigation. Indeed, Google claimed that he has his main European establishment in Ireland, thus the Irish data protection authority should examine the complaints.
Nevertheless, CNIL did not let to stop itself so easily. After a thorough examination, CNIL established that the Irish subsidiary of Google cannot be considered as a main establishment. The reason for that is that the Irish company does not have real decision-making powers in relation with the data processing, more precisely it does not define the purposes and means of the data processing.
After overcoming the competency obstacle, CNIL could start the examination of the substantive issues.
At first, CNIL has carried out a deep assessment of the information provided by Google for the users about the processing of their personal data and to put it mildly, he was not impressed at all.
Furthermore, the policies are not suitable for the users to understand the essence of Google’s data processing activities and their consequences to their private lives.
For example, the purposes of the data processing are described in a too generic manner and often the retention periods of the data are not defined.
4. What is the problem with the consent gained by Google?
Google thought that there could be no problem with the legal basis of its data processing since the users have given their consent, for instance when they created a Google account.
However, it is true that the users have given consent, but in CNIL’s opinion the consent is not valid for more reasons. As the information provided by Google about the data processing, as said earlier, is not appropriate, it is obvious that the consent based on that information is also inadequate. Indeed, the condition of a valid consent is that it is based on sufficient information.
The other, maybe even more serious problem is that the ’consent’ collected from the users is neither specific nor unambiguous.
The reason for that is that Google has often used pre-ticked checkboxes for its consent requests. That means that the users should have done extra steps for not to consent to the data processing and not vice versa. But the ’silence means consent’ approach does not work based on the GDPR.
Moreover, Google has not requested the consent distinctly for each data processing purpose, but he made the user consent in full to every data processing purpose with one (pre-ticked) checkbox. And you do not need to be a data protection expert to understand that this is not OK.
5. Why is the amount of the fine 50 Million Euros?
Let’s see why CNIL was so ‘generous’ with the level of the fine-
To start, CNIL has considered that Google breached essential data protection obligations, in addition really seriously, like having a valid legal basis for the data processing and providing sufficient information to the data subjects about the data processing.
When assessing the level of the fine, CNIL has taken into account the industrial role of Google, meaning that Google processes a huge amount of data of many data subjects, since in France thousands of people create a Google account every day.
Further, among the data there are also sensitive ones such as which kind of applications are used or what are the shopping habits of the user. Moreover, Google’ economic model is partly based on ads personalization thus it needs to be expected that if Google does it then he shall do it right (at least from data protection point of view).
Finally, CNIL has considered that this is not a one-off, time limited infringement, but Google breaches the GDPR since a long time until this very day.
We are curiously waiting for the afterlife of the decision since it is not final yet. Indeed, the case could affect all applications developed for Android and every data processing which could have connection with Google such as the analysis of the webpages with Google Analytics. If there is any update, we sure will inform you.
WHY EMPLOYERS SHOULD DEFINE THE PLACE OF WORK WITH CARE IN HUNGARY? –DECISION OF THE CURIA
In a fresh judgement of the Curia the main question was how to define the working place in the labour contract. At first sight, this seems quite simple and it might be surprising why such a question needed to be decided by the highest forum. However, from our article summarizing the decisions of the Curia you will see that even a simple question can be misunderstood and can cost a fortune for the employer.Read more »
5 KEY CHANGES IN DATA PROTECTION IN HUNGARY FROM MAY 2019
It is not an April’s fool joke that almost one year after the GDPR entering into force, finally the Hungarian Parliament adopted the GDPR implementation act on 1st April. The act harmonizes various areas of the Hungarian legal system with the GDPR as it will amend more than 80 legal sources. In this short article we collected the 5 most important provisions of the implementation act.Read more »
WAIT-AND-SEE? – DECREASING APPETITE FOR LITIGATION UNDER NEW RULES IN HUNGARY
“I only believe in statistics that I doctored myself” goes the famous quote attributed to Winston S. Churchill. Well, it is out of question that the late British prime minister has not participated in the publication of the Hungarian Court Statistics for 2018, it is worth to have a look at the figures, how the New Civil Procedure Code has changed the appetite for litigation in 2018 in Hungary.Read more »