A Google spokesman has announced, a few days after the French data protection authority CNIL imposed a record fine of 50 million euros for a breach of the GDPR, that the company will appeal the decision. Google’s decision now forces the Paris State Council, the supreme French administrative court, to decide whether the punishment against the company is lawful.
The fine of EUR 50 million is the first major penalty imposed since the introduction of the GDPR in May 2018. Since the penalty is based on the total worldwide turnover of a company, a maximum penalty of 3.7 billion euros would have been possible in the case of Google.
Lack of information from users
The penalty was imposed because Google did not “clearly and comprehensibly” inform users about the use of their personal data for advertising purposes, even from the point of view of the CNIL’s data protectors. Users who are looking for the relevant information first have to “fight” through a series of documents, some of which are hidden by several links and buttons. In addition, the unnecessarily complex wording of the documents, which is difficult for laypersons to understand, is criticised. Companies are obliged by the GDPR to inform users in a transparent and understandable manner about how their collected data is used.
Google itself denies these accusations. The Group believes that the method used for personalised advertising provides a very transparent process for user consent. Google also stated that the decision should worry all tech companies, as other companies can expect similar penalties.
