.
.
.
.
News/ GDPR Breach: Google fined EUR 50 million
---
25/01/2019
---

The US tech giant, Google is finned EUR 50 million by France's data protection regulator, CNIL, for failing to comply with its General Data Protection Regulation (GDPR) obligations. This is the biggest GDPR fine yet to be issued by a European regulator and the first time that one of the tech giants has been found in breach with the new regulations that came into force in May 2018.

Complaints against Google were filed by two privacy rights groups: noyb and La Quadrature du Net. According to a statement by CNIL, Google failed to provide enough information to users about its data consent policies and didn't give them enough control over how their information is used. Specifically, CNIL explained that Google had not obtained clear consent to process user data because essential information was disseminated across several documents, and was accessible after several steps only, implying sometimes up to five or six actions. In addition, the option to personalize ads was "pre-ticked" when creating an account, which is contrary to GDPR rules.

This is not the first GDPR fine to have been issued. In December 2017, a Portuguese hospital was fined EUR 400,000 after its staff used bogus accounts to access patient records, while a German social media and chat service was fined EUR 20,000 in November 2017, for storing social media passwords in plain text. Also, a local business in Austria was also fined EUR 4,800 in October last year for having a security camera that was filming public space.

CNIL also stated that it set the fine at EUR 50 million in light of the severity of the infringement, however, if Google does not alter its ways, it can still be hit with further fines for non-compliance. Ultimately, the GDPR's power is not just about monetary penalties, but forcing changes to business models.

Serbia has recently enacted a new Data Protection Law, which presents a copy of the GDPR to a large extent, with its' applicability postponed for 21 August 2019. As a result, Serbian companies will have to ensure the compliance of their data processing operations by that time, which will not be a quick or easy task, as it involves substantial legal, technical and organizational adjustments.

Related People

Related Views

Views

The use of AI in Law: How just is machine justice?

19/04/2018
Views

Moving with the Times – The Impact of Technology on the Business of Law

11/04/2016
Views

Macedonia Enacts New Amendments

01/04/2016
Views

Slovenia Reforms Public Procurement System

31/03/2016
Views

The Limits of Privacy – Apple vs. FBI Data Protection Case

14/03/2016
Views

Macedonian ‘Safe Harbour’ agreement ruled invalid by the European Court of Justice

19/11/2015