Google has been fined £44m (50 million euros) by CNIL (French data regulatory) for breaching European Union’s data protection rules and regulations. The regulatory agency said that it had given the fine to Google for “lack of transparency, inadequate information and lack of valid consent regarding ads personalization”. The case became strong according to the regulator against Google because according to them general public were not sufficiently informed about how the search engine i.e. Google accumulated data to personalize advertising to each individual and that goes against the rules and regulations of EU. Google is the worlds leading search engine with maximum share of global usage in searches. Google is the go-to tool and search engine for all digital marketing firms.
Google released a statement saying it was “studying the decision” to establish its next action. One must keep in mind that other companies and giants of the industry are also under investigation by the regulator for similar GDPR complaints.
The Irish regulator is not well-formed and does not have the necessary decision making authority over the Android operating system and services hence even with Google headquarters for Europe being in Ireland the case was handled by the French regulator.
Noyb & La Quadrature du Net (LQDN) were the two privacy groups who had filed the complaint against Google in May 2018 which resulted in the fine. The legislation of General Data Protection Regulation (GDPR) took effect on 25 May 2018 and the very first complaint under this legislation was filed on the very same day. The privacy rights group who filed the complaint asserted that there was no valid legal basis for Google to personalize user data for advertisement and process it, keeping in mind that this is mandated by GDPR.
Google did not have a valid legal basis for processing of the user data for personalized ads according to the regulator. According to the regulator “The information on processing operations for the ads personalization is diluted in several documents and does not enable the user to be aware of their extent,”. Google had given the option for users to uncheck the option of personalized ads when creating an account but the option is by default checked for users by Google which according to GDPR is against the rules.
“People expect high standards of transparency and control from us. We’re deeply committed to meeting those expectations and the consent requirements of the GDPR.”
said Google official statement.
The regulator also said
“Users are not able to fully understand the extent of the processing operations carried out by Google.”
What will this judgment mean for other companies who are under investigation and have complaints against them regarding similar issues? only time will tell.