French DPA concludes its first investigation; fining Google LLC €50 million in the process
On 21 January 2019, the French Data Protection Authority, the Commission nationale de l'informatique et des libertés (the “CNIL”) imposed a financial penalty of €50 million on Google LLC (“Google”) for a number of breaches of the General Data Protection Regulation (the “GDPR”). The CNIL found Google guilty of two breaches of the GDPR. Firstly, Google violated the principle of “lawfulness, fairness and transparency” and secondly, Google violated the requirement to have a “lawful basis for processing” when sending personalised ads.
Breach 1: Lack of Transparency
The CNIL found that Google’s fair processing information was lacking in both detail and clarity. The CNIL identified that essential information, such as: the data processing purposes, the data storage periods and the categories of personal data used for the personalisation of ads is excessively disseminated across several documents, meaning it is only possible to view relevant information after 5 or 6 click through actions. Such a process is at odds with the “transparency” principle of article 5.1(a) of the GDPR and has the effect of preventing service users from fully understanding the extent of the processing operations carried out by Google.
Breach 2: Lack of valid consent
Under article 7 of the GDPR consent is valid only where this is unambiguous and involves a clear affirmative action i.e. an opt in. In addition, distinct consent options must be given where there are a number of processing operations undertaken. The CNIL found that Google failed to adhere to these requirements for valid consent in two ways. Firstly, as information on the ads personalisation process is spread across several documents it does not enable the user to fully understand the extent of such processing and, as such, users are not sufficiently informed of the processing operations undertaken. Secondly, users were not able to provide specific or unambiguous consent because users are asked to tick a box providing a general consent to Google’s terms of service and processing of their user information. Given users are not able to opt in or out of one or more processing operations but instead are required to provide a blanket consent to Google’s processing operations, the CNIL found this is not GDPR complaint consent.
It is particularly interesting that the investigation came in response to two group complaints one of which was received on 25 May 2018 (i.e. GDPR day). In the lead up to the GDPR the difficulties the digital advertising sector would face were much publicised and debated; this investigation demonstrates an immediate challenge on the compliance one of the largest players in the sector and highlights the ongoing difficulties of achieving compliance. The CNIL noted the level of penalty was such because the breaches of the GDPR set out above were continuous and still observed at the date of the publication of its findings. Importantly, this investigation shows that the relevant data protection authorities are prepared to use their new GDPR powers which is especially challenging for the digital advertising sector given others might suffer the same fate, were they to be investigated.
This article was written by Rachel Bell. If you would like to contact Rachel please call +44 (0)20 7427 6573 or email Rachel.Bell@crsblaw.com.
When can you set off claims against different elements of a project
The Court’s decision raises important drafting considerations for construction contracts involving multiple elements of a project.
Drafting terms and conditions or negotiating a contract? Be wary of "unusual" and "exorbitant" exclusion clauses
When drafting a set of terms and conditions, companies must adhere to the requirements contained in the Unfair Contract Terms Act 1977
Stop, collaborate and listen: Top 10 Tips with Collaboration Agreements
Providing you with the top ten tips on collaboration agreements - what should you know?
Preparing your company for sale
We set out here some initial steps to consider in anticipation of a sale.
ESG investment and the challenges for trustees
What challenges does the ESG revolution present for trustees of private family trusts?
The impact of COVID-19 on commercial and residential tenancies
What impact has COVID-19 had on commercial and residential tenancies? Read more here.
Charles Russell Speechlys advises discoverIE on its acquisition of Antenova
discoverIE is a leading international designer, manufacturer and supplier of customised electronics to industry.
Q&A: Separate blocks, common parts and enfranchisement
Miriam Seitler and Lauren Fraser answer queries relating to leaseholders seeking to acquire the freehold.
2020: Influencer, 2021: Creative Director – what could go wrong?
Coded messages for landlords and tenants
“What does the code of practice mean for landlords and tenants? Read more here”
The family court’s role in micro managing 'trivial' disputes
The recent decision has dealt with the family court’s role in micro managing “trivial” disputes in relation to children
Taxing horizons and fiscal black holes
A super-massive black hole at the centre of the nation’s finances means that tax reform and rates rises look increasingly likely.
Charles Russell Speechlys advises Acora on acquisition of Westgate IT
Westgate IT specialises in providing IT support to businesses in the South West.
Jason Saiban writes for Food Manufacture on the food industry's climate change challenge
The key challenge will be how the environmental targets are actually met.
Q&A: Wrestling with restrictive covenants
Camilla Lamont (barrister at Landmark Chambers) and Real Estate Disputes Partner Emma Humphreys answer a pair of covenant queries
Charles Russell Speechlys advises Grape Paradise on the acquisition of a fine wine business
Charles Russell Speechlys has advised Grape Paradise on the acquisition of the Sarment Group in the China Mainland territories.
Grab the tail by the horns - Why is tail spend so critical in today’s outsourced portfolio?
It’s usually invisible, but in all likelihood, you’ve got tail spend.
Collateral Warranties – Are they also a ‘Construction Contract’?
What are collateral warranties and what do they mean for your construction contracts? Read more here.
Succession Planning for Landed Estates
The first in our series of articles on succession planning for landed estates covering a wide variety of matters.