French Data Protection Authority (CNIL) imposes a financial penalty of 50 Million euros against GOOGLE LLC (January 21, 2018)

​Having received group complaints from two data protection associations, and after having carried out investigations against GOOGLE during several month, the CNIL observed two types of breaches of the GDPR:

• The information provided by GOOGLE would not be easily accessible for users. Essential information, such as the data processing purposes, the data storage periods or the categories of personal data used for the ads personalization, would be disseminated across several documents, requiring the user up to 5 or 6 actions. Moreover, users would not not able to fully understand the extent of the processing operations carried out by GOOGLE.
  
• The CNIL also found that the user’s consent to process data for ads personalization purposes would not be validly obtained since the users’ consent would not be sufficiently informed and neither “specific” nor “unambiguous”.
   

The CNIL recalls with this decision that users must be enabled to control their data and be to sufficiently informed to allow them to validly consent. In the case of GOOGLE, the CNIL stated that the processing operations were particularly massive and intrusive because of the number of services offered (about twenty), the amount and the nature of the data processed and combined.

Google does not exclude appealing this decision.

For more details on the decision, please click here »