French data protection agency CNIL has fined Google EUR 150,000 upon considering that the privacy policy implemented by the company since 1 March 2012 does not comply with the country’s data protection act. CNIL also has ordered Google to publish a statement on the decision at the Google.fr homepage by 11 January.
In its decision, CNIL’s sanctions committee said that the data processed by the company about the users of its services in France must be qualified as personal data. It also judged that French law applies to the processing of personal data relating to internet users established in France, contrary to the company's claim. CNIL did not challenge the legitimacy of the simplification objective pursued by the company’s merging of its privacy policies, yet it considers that the conditions under which this single policy is implemented are contrary to several legal requirements.
Google does not sufficiently inform its users of the conditions in which their personal data are processed, nor of the purposes of this processing. The company does not comply with its obligation to obtain user consent prior to the storage of cookies on their terminals. It also fails to define retention periods applicable to the data which it processes. Finally, the internet giant combines all the data it collects about its users across all of its services without any legal basis.
These conclusions are similar to those made by the Dutch and Spanish data protection authorities in November and December 2013 on the basis of their respective national laws.
