The CNIL provision vs Google
CNIL, on 21 January 2019, in response to a class action by two consumer rights protection associations, imposed a financial penalty of 50 million euro against GOOGLE LLC, for failure or incorrect application of the GDPR, in particular for:
- lack of transparency;
- inadequate information;
- lack of valid consent regarding ad customization.
In consideration of the evidences detected, the CNIL has:
- stressed the particular nature of the violations detected with regard to the lack of legitimacy of the processing and to the failure to comply with transparency and information obligations. The lack of respect for these essential obligations appeared particularly serious given the fact that the obligations established in terms of transparency and the regulatory provisions to be respected are fundamental guarantees that allow people to maintain control of their data.
- Viewed that the imputed deficiencies continue to date and the violations of the regulations are continuing. It has also been considered that the infringements detected do not only characterize a punctual, time-limited infringement of the company's obligations, nor a simple habitual violation to which the owner could have remedied at the time of the appeal.
- detected that the number of stakeholders is particularly significant: data from millions of users are treated irregularly in this context; there are therefore a lot of the information treated that, in particular, give in-depth information on the habits of people's lives, their opinions and social interactions. The data processed by the company therefore closely touch the identity and privacy of the users. There is also the possibility of operating combinations of data with almost unlimited potential which allows a massive and intrusive treatment of user data.
for these reasons:
- a fine of 50 (fifty) million euros has been imposed on Google LLC;
- the decision was made public on the CNIL website and on the Légifrance website. It was also decided that the provision will be anonymised at the end of two years starting from its publication.
For elaborate on