During the preparation of the GDPR, it was often pointed out in professional circles that Google and Facebook are the primary targets of the strictest data protection regime of the world. Well, a little more than half a year after the GDPR entered into force, the sword of the French data protection authority has hit Google. Let’s see why the authority awarded the tech-giant with a modest fine of 50 Million Euros?
1. Why did the authority initiate the investigation?
The first day of the applicability of the GDPR has just come and the representative associations None Of Your Business and La Quadrature de Net have gone straight to the French data protection authority (CNIL) to make complaints against Google.
The two associations collected the complaints of almost 10.000 data subjects and objected to Google’s data processing and data protection practices on similar grounds.
The major problem of the associations was that Google does not have a valid legal basis for processing personal data, especially when it comes to the data processing for ads personalization purposes. The complaint of the None Of Your Business concerned mainly the data processing in relation with the usage of the Android operation system.
2. Why did the French authority act?
The fact that the representative associations filed the complaints with the CNIL, did not make it fully clear that the French authority shall make the investigation. Indeed, Google claimed that he has his main European establishment in Ireland, thus the Irish data protection authority should examine the complaints.
Nevertheless, CNIL did not let to stop itself so easily. After a thorough examination, CNIL established that the Irish subsidiary of Google cannot be considered as a main establishment. The reason for that is that the Irish company does not have real decision-making powers in relation with the data processing, more precisely it does not define the purposes and means of the data processing.
After overcoming the competency obstacle, CNIL could start the examination of the substantive issues.
3. What is wrong with Google’s privacy policy?
At first, CNIL has carried out a deep assessment of the information provided by Google for the users about the processing of their personal data and to put it mildly, he was not impressed at all.
As a starting point, before examining the merits, CNIL has found the availability of the privacy policy(ies) problematic. In fact, in order to receive all the details, the user needs to review more documents which are often only available after 5-6 clicks.
Furthermore, the policies are not suitable for the users to understand the essence of Google’s data processing activities and their consequences to their private lives.
For example, the purposes of the data processing are described in a too generic manner and often the retention periods of the data are not defined.
4. What is the problem with the consent gained by Google?
Google thought that there could be no problem with the legal basis of its data processing since the users have given their consent, for instance when they created a Google account.
However, it is true that the users have given consent, but in CNIL’s opinion the consent is not valid for more reasons. As the information provided by Google about the data processing, as said earlier, is not appropriate, it is obvious that the consent based on that information is also inadequate. Indeed, the condition of a valid consent is that it is based on sufficient information.
The other, maybe even more serious problem is that the ’consent’ collected from the users is neither specific nor unambiguous.
The reason for that is that Google has often used pre-ticked checkboxes for its consent requests. That means that the users should have done extra steps for not to consent to the data processing and not vice versa. But the ’silence means consent’ approach does not work based on the GDPR.
Moreover, Google has not requested the consent distinctly for each data processing purpose, but he made the user consent in full to every data processing purpose with one (pre-ticked) checkbox. And you do not need to be a data protection expert to understand that this is not OK.
5. Why is the amount of the fine 50 Million Euros?
Let’s see why CNIL was so ‘generous’ with the level of the fine-
To start, CNIL has considered that Google breached essential data protection obligations, in addition really seriously, like having a valid legal basis for the data processing and providing sufficient information to the data subjects about the data processing.
When assessing the level of the fine, CNIL has taken into account the industrial role of Google, meaning that Google processes a huge amount of data of many data subjects, since in France thousands of people create a Google account every day.
Further, among the data there are also sensitive ones such as which kind of applications are used or what are the shopping habits of the user. Moreover, Google’ economic model is partly based on ads personalization thus it needs to be expected that if Google does it then he shall do it right (at least from data protection point of view).
Finally, CNIL has considered that this is not a one-off, time limited infringement, but Google breaches the GDPR since a long time until this very day.
We are curiously waiting for the afterlife of the decision since it is not final yet. Indeed, the case could affect all applications developed for Android and every data processing which could have connection with Google such as the analysis of the webpages with Google Analytics. If there is any update, we sure will inform you.
