Google fined €50 million for lack of clarity about data processing
The French privacy watchdog CNIL fined Google 50 million euros for violating the General Data Protection Regulation. It concerns a lack of transparency and unclear information with regard to consent for personalized advertisements.
According to the CNIL, there are multiple violations of the General Data Protection Regulation. In this study, the CNIL looked specifically at the process that users must go through if they need to create a Google account while configuring mobile devices running Android.
The privacy watchdog states that the information that Google presents to users is not easily accessible. For example, the CNIL believes that ‘essential information’ is spread too much over different documents, whereby different buttons and links have to be pressed to be able to consult the information. This concerns, for example, the purpose of data processing, the duration of the data storage and the categories of personal data for advertising purposes. According to the regulator, this type of relevant information is sometimes only visible after five or six steps.
In addition, some information is not always clear or complete. According to the CNIL, this means that users are not able to fully understand the scope of data processing by Google. The regulator states that, for example, the purposes of the data processing are described too vaguely, as are the categories of data processing. Furthermore, the retention period of data is not always described and there is uncertainty about the legal basis for processing personalized advertisements.
The French privacy watchdog also notes that the consent that users must give to Google, so that their data can be used for personalized advertisements, is not validly obtained for two reasons. Firstly, the CNIL states that users are not sufficiently informed about the consent. For example, the section on personalized ads does not make it clear to users that it concerns a multitude of services, websites and apps, including Google’s search engine, YouTube, Google Maps and the Play Store. In addition, the consent is not specific and unambiguous, according to the CNIL. According to the AVG, unambiguity only exists if the user has to actively take an action, for example by checking the box; the privacy watchdog has established that the permission to show personalized advertisements is already checked by default.
The AFP reports that a spokesperson for Google has said that the company is strongly committed to meeting the expectations about transparency and the conditions arising from the General Data Protection Regulation. The spokesperson stated that his company is studying the CNIL’s decision, after which it is determined what next steps will be taken. It is therefore still unknown whether Google will contest the fine or how exactly it will respond to the decision of the French regulator.