log in
All Articles | Back

Member Articles


GDPR Breach: Google Fined EUR 50 Million 

by Sanja Spasenovic, Goran Radosevic

Published: January, 2019

Submission: January, 2019

 



The US tech giant, Google is fined EUR 50 million by France's data protection regulator, CNIL, for failing to comply with its General Data Protection Regulation (GDPR) obligations. This is the biggest GDPR fine yet to be issued by a European regulator and the first time that one of the tech giants has been found in breach with the new regulations that came into force in May 2017.


Complaints against Google were filed in May 2018 by two privacy rights groups:noybandLa Quadrature du Net. According to a statement by CNIL, Google failed to provide enough information to users about its data consent policies and didn't give them enough control over how their information is used. Specifically, CNIL explained that Google had not obtained clear consent to process user data because essential information was disseminated across several documents, and was accessible after several steps only, implying sometimes up to five or six actions. In addition, the option to personalize ads was "pre-ticked" when creating an account, which is contrary to GDPR rules.


This is not the first GDPR fine to have been issued. In December 2017, a Portuguese hospital was fined EUR 400,000 after its staff used bogus accounts to access patient records, while a German social media and chat service was fined EUR 20,000 in November 2017, for storing social media passwords in plain text. Also, a local business in Austria was also fined EUR 4,800 in October last year for having a security camera that was filming public space.


CNILalso stated that it set the fine at EUR 50 million in light of the severity of the infringement, however, if Google does not alter its ways, it can still be hit with further fines for non-compliance. Ultimately, the GDPR's power is not just about monetary penalties, but forcing changes to business models.


Serbia has recently enacted a new Data Protection Law, which presents a copy of the GDPR to a large extent, with its' applicability postponed for 21 August 2019. As a result, Serbian companies will have to ensure the compliance of their data processing operations by that time, which will not be a quick or easy task, as it involves substantial legal, technical and organizational adjustments.


 



Link to article

 

MEMBER COMMENTS

 

 

WSG Member: Please login to add your comment.

    Disclaimer

WSG's members are independent firms and are not affiliated in the joint practice of professional services. Each member exercises its own individual judgments on all client matters.

HOME | SITE MAP | GLANCE | PRIVACY POLICY | DISCLAIMER |  © World Services Group, 2019