€50m GDPR fine for Google is a wake-up call for tech giants

The first significant fine, equivalent to £44m, has been levied on Google by the French data regulator, the CNIL, for lack of transparency, inadequate information and lack of valid consent regarding the personalisation of advertisements.

The fine was levied by the CNIL after an investigation into complaints received in May 2018 from the associations None Of Your Business (NOYB) – the European centre for digital rights championed by privacy activist Max Schrems on behalf of 10 individuals – and La Quadrature du Net, which was mandated by 10,000 people to refer the matter to the CNIL.

Although Google’s European headquarters are in Ireland, the CNIL said the one-stop-shop mechanism was not applicable because Google does not have one main establishment in the EU and the Irish data protection authority “did not have a decision-making power on the processing operations carried out in the context of the operating system Android and the services provided by Google in relation to the creation of an account during the configuration of a mobile phone”.

In the two complaints, the associations reproach Google for not having a valid legal basis to process the personal data of the users of its services, particularly for advertisement personalisation purposes.

CNIL found that users were “not sufficiently informed” about how Google collected data to personalise advertising, that Google had not obtained clear consent to process data because “essential information” was “disseminated across several documents”, that the relevant information is accessible only after several steps, and that, as a result, “users are not able to fully understand the extent of the processing operations carried out by Google”.

The CNIL found that the option to personalise ads was “pre-ticked” when creating an account, which was then used as the basis for all the processing operations carried out by Google. But the CNIL said this did not respect the EU’s General Data Protection Regulation (GDPR), which says the consent is “specific” only if it is given distinctly for each purpose.

This fine is the first imposed by the CNIL under the GDPR and it warns that as the infringement is continuing, and it also involves the Android mobile operating system, further sanctions are on the agenda. “It is not a one-off, time-limited infringement,” the regulator said.

In a statement, Google said: “People expect high standards of transparency and control from us. We are deeply committed to meeting those expectations and the consent requirements of the GDPR.” The company also said it was “studying the decision” to determine its next steps.

Max Schrems, chairman of NOYB, said: “We are very pleased that, for the first time, a European data protection authority is using the possibilities of GDPR to punish clear violations of the law.

“Following the introduction of GDPR, we have found that large corporations such as Google simply ‘interpret the law differently’ and have often only superficially adapted their products. It is important that the authorities make it clear that simply claiming to be compliant is not enough.

“We are also pleased that our work to protect fundamental rights is bearing fruit. I would also like to thank our supporters who make our work possible.”

As the highest fine imposed by the CNIL to date, this punishment sends a serious warning to Google that the CNIL will not hesitate to use its powers where it deems the case at hand serious, according to Sonia Cissé, managing associate at law firm Linklaters.

“More than just a significant amount of money, this sanction is particularly detrimental to Google as it directly challenges its business model and will, in all likelihood, require it to deeply modify its provision of services,” she said.

And the CNIL decision goes way beyond Google, said Cissé. “Indeed, companies like Facebook, Amazon, but also any companies with a similar business model based on the processing of personal data for targeted advertising, could be sanctioned with high fines in the near future.

“With this decision, the CNIL is sending a strong message to companies with business models which are not complying with the requirements of the GDPR,” she said, adding that if other regulators come to the conclusion that Google is breaching the GDPR, then significant administrative fines could also be imposed elsewhere.

The CNIL fine has met a mixed reaction, with some welcoming the decision and others critical of the CNIL for not working with Google to improve the business model.

Among those who have welcomed the decision is Kevin Curran, professor of cyber security at Ulster University and senior member of the Institute of Electrical and Electronics Engineers (IEEE).

“The spirit of GDPR is that any data collected on the consumer should be accurate, protected and available to individuals to collect, move, delete, modify and view, and that they should only collect what is necessary,” he said. “In addition, consent should be freely given. In other words, companies should not capture too much data, or treat it lightly and also not use covert measures to opt users into services.”