France’s data protection watchdog Cnil has issued Google with a EUR 50 million fine following an inquiry prompted by complaints filed in May 2018 by two non-profit organizations. The investigation was carried out in September 2018, in response to two separate complaints from French consumer rights association La Quadrature du Net and data protection group NOYB (None of your business), led by Max Schrems.
The Cnil found Google committed two main types of violations under the EU’s GPDR (General Data Protection Regulation) in how it signs up Android users. Firstly, the company failed in its obligation to provide end-users with essential information and transparent descriptions of its data processing practices. Secondly, it was found in breach of its duty to obtain valid consent from end-users to process data for ad personalisation purposes.
For this second infringement, the watchdog’s investigation shows that user consent is not legitimately obtained, with relevant information diluted across several documents. Additionally, consent is found to be neither “specific” nor “unambiguous”. For example, while Google enables users to modify options associated with ad personalisation, configuration is pre-ticked and this amounts to a GPDR infringement.
Commenting on the fine imposed, the first major sanction under the GDPR, the Cnil described its findings as “continuous breaches” that can still be observed to date, rather than one-off, time-limited, failings. The watchdog said that the breaches linked to Google's data processing practices deprive end-users of essential guarantees, posing the risk of revealing important aspects of a user’s private life.
Google had raised doubts over France’s competency in handling the case, as the company is headquartered in Ireland. Following discussions with other European counterparts, the watchdog established that the GDPR entitled it to lead the probe. On this point, it stated that Google's Irish operations are not involved in the confidentiality rules imposed on users configuring a new Android smartphone.
