Google fined record €50m by French data commission
French data protection commission the CNIL has imposed a record fine of €50 million on US tech giant Google, after concluding that the company had not been transparent enough with its users.
On Monday this week, la Commission Nationale de l’Informatique et des Libertés (CNIL) concluded that Google’s management of and communication about users’ personal data in France had been insufficient.
The decision comes after a group complaint was submitted to the CNIL by online privacy associations None of Your Business (NOYB) and La Quadrature du Net (QDN), comprising over 10,000 signatures in support.
The complaint was submitted just as the new European regulation, GDPR (General Data Protection Regulation) came into force on May 25 2018 - a new law designed to protect the use of people’s data.
Under GDPR, users must explicitly consent (or opt-in) to their data being used for marketing and commercial purposes, and be fully informed of the ways in which their data will be used.
The CNIL said that Google had not sufficiently respected the conditions of GDPR, and found that even users that had opted-in under GDPR rules “were not enabled to understand the scope of processes put in place by Google.”
Referring to Google’s large suite of programs and services, such as Google Search, Gmail, YouTube, Google Maps, Play Store, and Google Photos, CNIL said: “In addition, these processes are particularly wide-reaching and intrusive.”
The commission also accused Google of “forcing users’ hands”, by making the sharing of their data “the default option”, and for not offering a separate opt-in agreement for each distinct Google service used.
It said that Google had forced users to “consent in bulk to all the possible ends pursued by Google”.
Upon being asked to justify its actions to CNIL, the tech company failed to convince the French commission, and was then handed this “serious” sanction as an example.
Google now has four months to contest the decision before the Conseil d’Etat. The French arm of the US giant has said it is studying CNIL’s decision “to determine its next steps”.
Yet, despite the large fine, the complainants have argued that the CNIL did not go far enough.
QDN has said that it is disappointed with the size of the fine, given that the law states that a company can be fined up to 4% of its overall worth. In 2017, this would have equalled USD 110 billion (€97 billion) for Google parent company Alphabet.
Benjamin Bayart, one of the founders of QDN, said: “The CNIL has only addressed one tiny part of the problem.”
He claimed that any individuals using Android phones (a Google-made operating system present on many smartphones) would still be required to share significant personal data with the company. He also said that Google had “other ways” to gather data on people.
By way of explanation, he asked: “How is it possible, that I - with no Google account whatsoever - should then be offered [by Google] the option to watch Episode 3 of a certain series, after having watched Episodes 1 and 2 previously elsewhere?”
But Mr Bayart said that although CNIL had made its decision “in the simplest legal terms”, the size of the fine was significant.
He said: “If all European authorities fined Google €50 million, it would begin to get interesting. On the other hand, if this is the only €50 million fine in Europe, it is not enough of a price to pay.”
