Record data protection fine imposed by the French Data Protection Authority

The French Data Protection Authority (the CNIL) has imposed the highest data protection fine in history, an amount of EUR 50 million against Google for GDPR violations concerning individuals using Android-operated smart phones.

The CNIL established that the information provided by Google to the data subjects was not sufficiently easily accessible for users. This is because the information that the GDPR requires Google to provide – for example on the purpose of data processing, categories of personal data and storage periods – was contained in several, different documents (which is a violation of the transparency principle). This was the case when a user wished to educate himself about data processing concerning ad-personalization purposes and geo-tracking services. The CNIL also established that some of the data processing purposes were worded in a too generic and vague manner and that the storage period was not specified for certain data.

Google stated the data subjects’ consents as being the legal basis for the purposes of ad-personalization. However, as the CNIL established, Google failed to obtain informed consents of the data subjects as the information given was quite vague and not precise enough. The CNIL also held that the consents were not specific and unambiguous as a pre-ticked box was used for ad-personalization, and, moreover, that one consent box was used for several data processing purposes which is also not in line with the GDPR.

Since the violations affected a large number of individuals and concerned the principle of transparency, information, and consent, the CNIL found a fine of EUR 50 million to be proportionate with the infringements.

Zoltán Balázs Kovács, J.D. (LL.M.), Partner, Szecskay Attorneys at Law, Budapest, Hungary (zoltan.kovacs@szecskay.com)

The contents of this post are intended to provide only a general overview of the subject matter and do not qualify as legal advice.