The French Data protection agency CNIL released a statement Monday stating that the staggering €50 million ($56.8mn) fine was motivated by complaints about the company’s illegal practices in the collection and use of personal data. At present, there is no reliable information available on how long the company saves user data, nor if they allow it to be used by other sites.
Around 10,000 people signed the initial petition to initiate an investigation, which was filed by France’s Quadrature du Net group and None Of Your Business, an NGO which advocates for consumer privacy.
The investigation turned up two infractions to the EU’s General Data Protection Regulation (GDPR) which was approved in 2016. They found that the company doesn’t provide easy access to information it collects from users and that the information they do provide is often incomprehensible. This creates a situation where people are not able to manage how their information is being used, especially in relation to targeted ads.
Users’ “consent” is currently set as the global default setting, which fails to meet the regulator’s requirement that companies obtain “specific” consent. They also say that the pop-ups currently used by the company to ask for consent on Android software seem to threaten that services will not be available if the users don’t accept the terms.
While the number looks over-the-top, CNIL says that the fine was decided “by the severity of the infringements observed,” as well as Google’s position in the French market.
Although Google responded to the decision by saying that they committed to meeting the “high standards of transparency and control” expected of them by users – as well as by the strict new EU data law – they are nonetheless challenging the decision. While no official decision has been made as of yet, the European Court of Justice in Luxembourg sided with the company last month.
While the fine in question is unprecedented, CNIL has already forced Google to pay hundreds of thousands of Euros over similar issues, including the web giant's failure to adhere to the EU’s “right to be forgotten” law, which requires search engines to allow users to have their names removed from “outdated or irrelevant” search results.
Google also found itself in hot water last month when a Dutch court produced documents showing the company had used an offshore account to avoid paying taxes on billions of dollars in revenue.