France's data-protection commission, the "Commission Nationale de I'Informatique et des Libertes" (CNIL), has notified Google that it filed a formal sanction proceeding that could lead to fines, alleging the US internet company's handling of French user data violates European privacy law. The privacy watchdog said it filed the sanctions because Google missed a three-month deadline to comply with an order to change its treatment of user data. CNIL did not specify the amount of the fine it might seek, but a person briefed on the matter told the Wall Street Journal that the agency was considering whether it would be legally possible to treat every user in France as an infraction, allowing it to multiply the fines beyond the current maximum of EUR 150,000 for first offences. A Google spokesman repeated that the company's "privacy policy respects European law" and that it had "engaged fully in the CNIL throughout this process".
Regulators in five more EU countries, Germany, Italy, Spain, the Netherlands and the UK, are leading parallel investigations into Google's privacy practices that could result in sanctions and fines. In Spain, Google faces a fine of up to EUR 1.5 million. In Italy, the fine could rise above EUR 1.2 million, while in the German city of Hamburg, fines could total EUR 1 million, the regulators said. At the core of the issue is the privacy policy Google detailed in early 2012, allowing services such as Gmail and YouTube to share user data. In late June, in coordination with similar moves in other countries, France ordered six remedies from Google, such as explicitly defining how long it keeps each type of user data, and ceasing to combine users' personal data from different Google services "without legal basis". CNIL said Google waited until the expiration of its three-month deadline to inform the agency that it contested the findings and that it did not believe it is violating European privacy laws.
