Blog » 50 MILLION EURO GIGA GDPR-FINE FOR GOOGLE – SURE WE HAVE A COMMENT!
50 MILLION EURO GIGA GDPR-FINE FOR GOOGLE – SURE WE HAVE A COMMENT!
06 February 2019
During the preparation of the GDPR, it was often pointed out in professional circles that Google and Facebook are the primary targets of the strictest data protection regime of the world. Well, a little more than half a year after the GDPR entered into force, the sword of the French data protection authority has hit Google. Let’s see why the authority awarded the tech-giant with a modest fine of 50 Million Euros?
1. Why did the authority initiate the investigation?
The first day of the applicability of the GDPR has just come and the representative associations None Of Your Business and La Quadrature de Net have gone straight to the French data protection authority (CNIL) to make complaints against Google.
The two associations collected the complaints of almost 10.000 data subjects and objected to Google’s data processing and data protection practices on similar grounds.
The major problem of the associations was that Google does not have a valid legal basis for processing personal data, especially when it comes to the data processing for ads personalization purposes. The complaint of the None Of Your Business concerned mainly the data processing in relation with the usage of the Android operation system.
2. Why did the French authority act?
The fact that the representative associations filed the complaints with the CNIL, did not make it fully clear that the French authority shall make the investigation. Indeed, Google claimed that he has his main European establishment in Ireland, thus the Irish data protection authority should examine the complaints.
Nevertheless, CNIL did not let to stop itself so easily. After a thorough examination, CNIL established that the Irish subsidiary of Google cannot be considered as a main establishment. The reason for that is that the Irish company does not have real decision-making powers in relation with the data processing, more precisely it does not define the purposes and means of the data processing.
After overcoming the competency obstacle, CNIL could start the examination of the substantive issues.
At first, CNIL has carried out a deep assessment of the information provided by Google for the users about the processing of their personal data and to put it mildly, he was not impressed at all.
Furthermore, the policies are not suitable for the users to understand the essence of Google’s data processing activities and their consequences to their private lives.
For example, the purposes of the data processing are described in a too generic manner and often the retention periods of the data are not defined.
4. What is the problem with the consent gained by Google?
Google thought that there could be no problem with the legal basis of its data processing since the users have given their consent, for instance when they created a Google account.
However, it is true that the users have given consent, but in CNIL’s opinion the consent is not valid for more reasons. As the information provided by Google about the data processing, as said earlier, is not appropriate, it is obvious that the consent based on that information is also inadequate. Indeed, the condition of a valid consent is that it is based on sufficient information.
The other, maybe even more serious problem is that the ’consent’ collected from the users is neither specific nor unambiguous.
The reason for that is that Google has often used pre-ticked checkboxes for its consent requests. That means that the users should have done extra steps for not to consent to the data processing and not vice versa. But the ’silence means consent’ approach does not work based on the GDPR.
Moreover, Google has not requested the consent distinctly for each data processing purpose, but he made the user consent in full to every data processing purpose with one (pre-ticked) checkbox. And you do not need to be a data protection expert to understand that this is not OK.
5. Why is the amount of the fine 50 Million Euros?
Let’s see why CNIL was so ‘generous’ with the level of the fine-
To start, CNIL has considered that Google breached essential data protection obligations, in addition really seriously, like having a valid legal basis for the data processing and providing sufficient information to the data subjects about the data processing.
When assessing the level of the fine, CNIL has taken into account the industrial role of Google, meaning that Google processes a huge amount of data of many data subjects, since in France thousands of people create a Google account every day.
Further, among the data there are also sensitive ones such as which kind of applications are used or what are the shopping habits of the user. Moreover, Google’ economic model is partly based on ads personalization thus it needs to be expected that if Google does it then he shall do it right (at least from data protection point of view).
Finally, CNIL has considered that this is not a one-off, time limited infringement, but Google breaches the GDPR since a long time until this very day.
We are curiously waiting for the afterlife of the decision since it is not final yet. Indeed, the case could affect all applications developed for Android and every data processing which could have connection with Google such as the analysis of the webpages with Google Analytics. If there is any update, we sure will inform you.
DEBT COLLECTION IN HUNGARY -3 REASONS TO HIRE A LAW FIRM INSTEAD OF COLLECTION AGENCIES
One of the annoying things in business is when your invoices are not paid by your business partners. After getting bored of their excuses, there comes a time when you have to put pressure on your debtor. At that point, you either entrust a law firm or turn to one of the many debt collection agencies offering “simple and cheap, yet efficient” solutions. Are the latter solutions really that effective? Is it worth entrusting a debt collection agency in Hungary? In our article, we bring up three reasons why hire rather a law firm in Hungary instead collection agencies.Read more »
HOW TO INFORM DATA SUBJECTS ABOUT CCTV SURVEILLANCE IN A GDPR-COMPLIANT WAY?
Operating video surveillance in a GDPR-compliant way can be a real challenge for data controllers in Hungary. A key aspect of the compliance with the GDPR is how the controller informs the data subjects (e.g. employees or customers) about the CCTV surveillance. Luckily, the European Data Protection Board which is the data protection authority of the EU has recently published a guideline on this issue. Read our short summary so that you know what to include in your camera privacy notice.Read more »
CAN YOUR DEBTOR ESCAPE LIQUIDATION BY SETTING OFF CLAIMS IN HUNGARY?
The initiation of a liquidation procedure is an effective debt collection method, since the debtor may only avoid being liquidated by paying the claim if the conditions specified in the Act on Bankruptcy Proceedings and Liquidation (Bankruptcy Act) are met. For this reason, in the case of liquidation, one of the most common defences of the debtor is the reference to offsetting. But can the debtor refer to offsetting without limitation during liquidation? In our short article we answer this question.Read more »