Google Fined By French Privacy Regulator

← Back to Stories (view on slashdot.org)

Google Fined By French Privacy Regulator

Posted by Unknown on Thursday January 9, 2014 @08:59AM from the clause-37c-google-owns-your-firstborn dept.

First time accepted submitter L-One-L-One writes "Following similar decisions in Spain and the Netherlands, Google was fined 150,000 euros by the French Data Protection authority today for breaching data protection legislation. This sanction follows a long inquiry triggered by Google's decision to change its privacy policy in March 2012. The authority notably considers that the new policy 'does not sufficiently inform its users of the conditions in which their personal data are processed, nor of the purposes of this processing,' and that Google combines 'all the data it collects about its users across all of its services without any legal basis.' While the fine may be barely noticeable for Google, the authority requires the search giant to publish this decision on Google's French homepage, google.fr for 48 hours within the next 8 days."

55 comments

Min score:

Reason:

Sort:

It should be 150,000 per violation by Anonymous Coward · 2014-01-09 09:02 · Score: 0

150,000 is the value of a speck of dust which flakes off of Google. The fine should be per user and per violation and then we might get somewhere.
seems like a weird sanction by Trepidity · 2014-01-09 09:03 · Score: 1

Leaving aside the (also interesting) question of whether the law as written is a good or bad idea, the sanction doesn't seem to make any sense. Google changed its privacy policy in 2012, in a way that a French court finds doesn't comply with French law. As a result, they must 1) pay 150,000 euros; and 2) publicize a notice on google.fr for 48 hours. But after that, they can keep the offending policy? Seems like a strange law that you can just continue to ignore with a one-time sanction.

--
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
1. Re:seems like a weird sanction by Anonymous Coward · 2014-01-09 09:08 · Score: 0
  
  The whole concept of fining is corrupt.
  An individual or business should have money taken from it which corresponds to profits gained as a result of illegal actions. And that money should be returned whence it came.
  The business should immediately have to comply with the law.
  Finally, any sanctions should be imposed on major shareholders and directors, as if those people themselves committed the crime.
2. Re:seems like a weird sanction by Anonymous Coward · 2014-01-09 09:09 · Score: 1
  
  Of course not. If Google continues their, now illegal, behavior, they will face ever increasing fines and eventually criminal charges.
  You did not seriously expect otherwise, did you ?
3. Re:seems like a weird sanction by mythosaz · 2014-01-09 09:20 · Score: 1
  
  Google should return their money to, uh, their advertising partners?
4. Re:seems like a weird sanction by s.petry · 2014-01-09 09:25 · Score: 0
  
  Did you miss While the fine may be barely noticeable for Google, the authority requires the search giant to publish this decision on Google's French homepage, google.fr for 48 hours within the next 8 days? This means that the current politicians get a nice fat bonus check and everyone else gets the middle finger.
  
  --
  -The wise argue that there are few absolutes, the fool argues that there are no probabilities.
5. Re:seems like a weird sanction by pavon · 2014-01-09 09:27 · Score: 2
  
  Yeah that was my reaction as well. The link has slightly more information, and seems to imply that the current policy may comply with French Law, but the way the change took place did not:
  
  On the substance of the case, the Sanctions Committee did not challenge the legitimacy of the simplification objective pursued by the company’s merging of its privacy policies.
  Yet, it considers that the conditions under which this single policy is implemented are contrary to several legal requirements:
  If that is true, then the change was a one time offense, and a one-time remedy is fitting. That said, I think the remedy ought to have included a "redo" of the policy change not just a fine; declare that Google's users may choose to be bound by either the old or new policy until Google enacts the change in a manner that is in compliance with the law.
6. Re:seems like a weird sanction by Anonymous Coward · 2014-01-09 09:28 · Score: 0
  
  It is a win/win for all parties. French authorities are viewed as being able to put the heat to the evil US-ians, Google makes a few changes, and business goes back to usual.
7. Re:seems like a weird sanction by arielCo · 2014-01-09 09:31 · Score: 5, Informative
  
  They were ordered in June to comply with the French Data Protection Act within three months. Specifically, to:
  
  * Define specified and explicit purposes to allow users to understand practically the processing of their personal data;
  * Inform users by application of the provisions of Article 32 of the French Data Protection Act, in particular with regard to the purposes pursued by the controller of the processing implemented;
  * Define retention periods for the personal data processed that do not exceed the period necessary for the purposes for which they are collected;
  * Not proceed, without legal basis, with the potentially unlimited combination of users’ data;
  * Fairly collect and process passive users’ data, in particular with regard to data collected using the “Doubleclick” and “Analytics” cookies, “+1” buttons or any other Google service available on the visited page;
  * Inform users and then obtain their consent in particular before storing cookies in their terminal.
  Source
  
  --
  This post contains no rudeness or derision of any kind. All arguments are friendly. Terms and exclusions may apply.
8. Re:seems like a weird sanction by Anonymous Coward · 2014-01-09 10:05 · Score: 0
  
  This means that the current politicians get a nice fat bonus check
  What? Can you substantiate that with something?
9. Re:seems like a weird sanction by Cochonou · 2014-01-09 10:06 · Score: 3, Informative
  
  By the letter of the law, the CNIL has a very specific status: this 150 000 € fine is the maximum they can impose.
  They can also impose up to 300 000 € fines in case of second offenses, so I as I understand it, Google could be fined again if they keep the offending policy. This would require a new deliberation of the CNIL. They just cannot impose a fine per day of non-compliance like a court would.
10. Re:seems like a weird sanction by Anonymous Coward · 2014-01-09 10:19 · Score: 0, Redundant
  
  the law is most likely ok, the problem is that the fine is not proportional to the effects nor the size of the offending company.
  they should fine a company for the amount of users affected, otherwise they always get away with "oh it was a typo by some engineer" (like the street view collection of wifi packets), and/or a percentage of the earnings, otherwise it's just a joke which discriminates against small companies, for a small company this amount could easily destroy it, even if it had a few users. Google in turn is screwing millions of users, and yet this fine is nothing to them.
  Furthermore, they are actually saying that French law does not apply to them, just like they are arguing in the UK, so basically they are saying that they get to pick which laws apply to them, because when they are in the US, they say that US tax law does not apply to them.
  Fuck them.
11. Re:seems like a weird sanction by Stuntmonkey · 2014-01-09 10:57 · Score: 1
  
  Inform users and then obtain their consent in particular before storing cookies in their terminal
  Can someone please name for me a single site that obtains my consent before storing cookies in my terminal?
  This is the worst kind of law: Written so that everyone is breaking it, and therefore can be selectively applied to anyone. The French regulators wanted to get some positive press at home by beating up on a big American company. Let's all wait patiently while they issue the thousands of fines to French companies violating this same law.
12. Re:seems like a weird sanction by Anonymous Coward · 2014-01-09 11:07 · Score: 2, Informative
  
  I can name you hundreds of sites. This is a law in the Netherlands also, and every Dutch site asks for your permission. Want to try one: www.volkskrant.nl (a Dutch newepaper). Isn't it great when your government actually cares about your privacy.
13. Re:seems like a weird sanction by lgw · 2014-01-09 11:16 · Score: 1
  
  Can someone please name for me a single site that obtains my consent before storing cookies in my terminal?
  
  Bigcharts.com. A site that displays stock charts - you can configure the display, and when you hit "store settings" there's a pop-up explaining that they need to store a cookie for this purpose, and asking whether that would be OK.
  I always found that classy. And there's no technical reason not to - just acceptance and permissiveness by the user base.
  
  --
  Socialism: a lie told by totalitarians and believed by fools.
14. Re:seems like a weird sanction by davecb · 2014-01-09 14:36 · Score: 1
  
  My company does all that as a matter of course, to meet Ontario law. Surely Google can! I mean, they're not stupid...
  
  --
  davecb@spamcop.net
15. Re:seems like a weird sanction by tlambert · 2014-01-09 15:11 · Score: 1
  
  Inform users and then obtain their consent in particular before storing cookies in their terminal
  Can someone please name for me a single site that obtains my consent before storing cookies in my terminal?
  Google doesn't ask permission to store cookies because it does not use cookies.
16. Re:seems like a weird sanction by herve_masson · 2014-01-09 18:58 · Score: 1
  
  Can someone please name for me a single site that obtains my consent before storing cookies in my terminal?
  Many sites started to do this recently (slashdot to name one), but I find this rather useless since most people have no clue about what a cookie really is. What matters is what google (and others) do with your data, speciffically with the help of 3rd party sites.
  This is the worst kind of law
  Yeah, you're right, let's do nothing instead... no, kidding, I find this fair and balanced, even though the fine is ridiculously low. Google think they don't have to comply local regulation, this has to be fought.
  The french regulation used to have true power and has a good sense of what is ok and what is not in term of data collection and privacy. This became less and less true over time (thanks french politics) and their role is now really limited with the boom of data collection era. This sucks. We need more of this. A lot more. This has to start somewhere, and I'm hoping this is the begining of something here.
17. Re:seems like a weird sanction by Anonymous Coward · 2014-01-09 20:35 · Score: 1
  
  Inform users and then obtain their consent in particular before storing cookies in their terminal
  Can someone please name for me a single site that obtains my consent before storing cookies in my terminal?
  Slashdot?
  Browsing as AC, and not choosing to click yes or no, for every page, there is a giant notice:
  
  Your Choice Regarding Cookies on this Site
  Cookies are important to the proper functioning of a site. To improve your experience, we use cookies to remember log-in details and provide secure log-in, collect statistics to optimize site functionality, and deliver content tailored to your interests. Click Agree and Proceed to accept cookies and go directly to the site or click on More Information to see detailed descriptions of the types of cookies and choose whether to accept certain cookies while on the site.
18. Re:seems like a weird sanction by sjames · 2014-01-09 21:52 · Score: 1
  
  The notice was the part that didn't comply. Once they post the notice, they will be in compliance.
19. Re:seems like a weird sanction by Anonymous Coward · 2014-01-10 01:25 · Score: 0
  
  --
  Senior System Engineer/Architect
  Notice: If you post anonymously do not expect a reply.
  Are you aware your signature is bigger than most of your posts, and that nobody gives a shit about your fucking job title?
  Mostly it makes you seem like a complete wanker trying to impress people.
20. Re:seems like a weird sanction by Anonymous Coward · 2014-01-10 21:43 · Score: 0
  
  Of course not. If Google continues their, now illegal, behavior, they will face ever increasing fines and eventually criminal charges.
  You did not seriously expect otherwise, did you ?
  Does the French law even provide for prison sentences? And why the soft approach in the first instance? All it does is send a message to every other megacorp that they can do whatever they feel like and flout the law for a couple of insignificant fines, then maybe decide to follow the law when it looks like the handcuffs are on their way and Bubba is lubing up.
Stupid Link by EMG+at+MU · 2014-01-09 09:07 · Score: 1

Why does this summery link to itself?

I would expect google.fr to link to the French google homepage.
1. Re:Stupid Link by Anonymous Coward · 2014-01-09 09:40 · Score: 0
  
  Could be that "http://" was forgotten from the beginning of the link and thus it points to a (nonexistent) folder named "google.fr" under this article's URL.
It should be 150,000 per violation by Anonymous Coward · 2014-01-09 09:08 · Score: 0

It's only 1 / 71580 of their yearly profit, pre tax.
spare change in the couch by Gothmolly · 2014-01-09 09:12 · Score: 1

Sergey and Brin can scrape the spare change in the couch to pay this. Why would they care?

--
I want to delete my account but Slashdot doesn't allow it.
1. Re:spare change in the couch by kruach+aum · 2014-01-09 09:20 · Score: 1
  
  Holy shit, was there a massive scientific breakthrough at Google's anti-aging lab I missed?
2. Re:spare change in the couch by Anonymous Coward · 2014-01-09 09:23 · Score: 0
  
  I guess Larry Page has merged into Brin and is now a growth on his leg.
3. Re:spare change in the couch by Anonymous Coward · 2014-01-09 09:30 · Score: 0
  
  Old people don't have couches? Good to know. I gotta plan ahead.
4. Re:spare change in the couch by Anonymous Coward · 2014-01-09 09:47 · Score: 0
  
  I'm not quite sure, but I think the anti-aging comment was a joke about Sergey Brin cloning himself.
Ouch! by Anonymous Coward · 2014-01-09 09:25 · Score: 0

That's like fining regular people 15 cents. Google must be really be on their toes from now on.
no legal basis by duranaki · 2014-01-09 09:26 · Score: 1

Isn't France that country where "everything is allowed, unless strictly forbidden?" I'm fine with the notion Google didn't notify people enough, but why is unifying their data between services inherently illegal?
1. Re:no legal basis by bill_mcgonigle · 2014-01-09 10:07 · Score: 1
  
  why is unifying their data between services inherently illegal?
  Seems like a backdoor to un-approve M&A arrangements after they've happened.
  "Yeah, that's fine for you to buy this other company. :wait: Oh, you can't share data from the new business unit with the rest of your company."
  
  --
  My God, it's Full of Source!
  OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
2. Re:no legal basis by hurfy · 2014-01-09 10:16 · Score: 1
  
  I was hoping for an answer also.
  You agreed to give Google your data here and you agreed to give Google your info over there. That seems a legal basis to add the 2 to me.
3. Re:no legal basis by X-chan · 2014-01-09 10:56 · Score: 2
  
  I'm not a specialist about laws so I could be wrong, but we do have a bunch of privacy laws which states quite explicitely what you can and can't do with the data you collected. Each database containing private data must be declared to the CNIL, stating what kind of info you're gathering, for which purpose, etc. So you just can't acquire and merge a bunch of databases without any kind of justification because their combination would be a much greater threat to privacy than both databases separated.
4. Re:no legal basis by duranaki · 2014-01-09 11:15 · Score: 2
  
  Thanks for your comment, gave me something to look up: http://en.wikipedia.org/wiki/CNIL :) I'm still unsure on the language of the complaint, but I suppose the privacy laws may specifically outlaw connecting separate databases without some legally defined justification, and Google hasn't provided a legal basis that would grant them an exclusion. Of course I'm no expert either, especially in the field of French law. I wish one of those reporters would flush out the specific violation in this area.
5. Re:no legal basis by herve_masson · 2014-01-09 23:34 · Score: 1
  
  This reasoning does not work (at least not everywhere)
  Let's take an example. We have some corporation that provide banking and medical insurance services (and giving good prices when using both).
  Are you really okay with them crossing both data to evaluate the risk with granting you a loan ? I'm not. They technically "own" both data.
  I'm okay is they ASK me about my health, that's a different thing. They could event ask me the permission to read medical files as long as I can reply "no".Nobody will force me to answer this question If I don't want.
  That's just an example. We may find tons like that.
  I'm glad some country attempt to put some rules here. France is one of them; you have to inform regulator about what data is saved in your business, and HOW you'll use them. This is largely inefficient obviously, due to lack of power. This is what needs to be fixed.
Not 'chump change' by roman_mir · 2014-01-09 09:34 · Score: 0, Insightful

It's irrelevant what the fine is, it could be 100 bucks, it could be 100,000,000 dollars or 10 Billion for all I care, that's irrelevant. What is relevant is that some fucking nonsensical government anywhere in the world is allowed to destroy individual freedom of people like that, by fining individuals for offering services on their terms.
So Google merged privacy policies (which by the way, shouldn't be dictated by any gov't either, it's a personal choice for companies to provide it or not and it's up to the clients to care about those or not) so what? Is any single person in the world a PAYING gmail/youtube/maps/etc client? Even IF somebody is paying for something (maybe) how is it not up to THEM to yell at Google, to sue Google even and maybe to stop using their services?
This entire notion that government has a role in business anywhere in the world is completely out of control and needs to be stopped.

--
You can't handle the truth.
1. Re:Not 'chump change' by lgw · 2014-01-09 11:23 · Score: 2
  
  Effectively France is just policing fraud as they see it. If Google isn't honestly disclosing what they do with your information, then it's legitimate to think of this under the umbrella of "fraud prevention".
  I'm all for free markets with minimal regulation, but fraud prevention is absolutely a legitimate place for the government to be sticking its nose in. Just like contract enforcement, and standardization of weights and measures, you can't have a free market without a government fulfilling this role.
  
  --
  Socialism: a lie told by totalitarians and believed by fools.
2. Re:Not 'chump change' by robsku · 2014-01-21 01:54 · Score: 1
  
  Wow, yeah, I'm sure there are thousands of french marching on the streets for having their freedom taken away just as I'm sure that french government has these laws passed for selfish gain for politicians and having nothing to do with people growing angry towards corporations power/policies.
  Luckily google still has the option of stopping doing business in/with france and I'm sure they will be doing just that instea of informing people about their policies instead - It's not like you can freely do deals if there are pesky contract and end user/customer protection laws disturbing you're freedom to *ssrape the other party.
  
  --
  In capitalist USA corporations control the government.
What has payment to do with it by Anonymous Coward · 2014-01-09 09:44 · Score: 0

I can't follow your logic. If I don't pay you then you can harm me at will? Most virus writers are not paid by their "customers" either, should their activity also be encouraged?
1. Re:What has payment to do with it by roman_mir · 2014-01-09 09:59 · Score: 0
  
  What a weird non sequitur. Equating somebody actively harming you (by spreading a virus to you) to a business that may decide to provide or not provide 'privacy policy' or may change privacy policy on the fly, which means, that as a client you can either take them to court or stop using them and probably implying that government has a role in any of it..... I am not even able rightly to apprehend the kind of confusion of ideas that could lead to such ignorant statements.
  
  --
  You can't handle the truth.
2. Re:What has payment to do with it by Anonymous Coward · 2014-01-09 11:42 · Score: 1
  
  Unfettered collection and commercial use of people's personal data can have harmful consequences. That's exactly why we got various "privacy laws", to enforce corporation to keep this usage within some decent limits and prevent too much harm being done.
  Your argument "since you're not paying us we can hit you on the head with a baseball bat" doesn't hold any water. It is illegal to hit someone regardless of any contracts or payments or lack thereof.
Just shutdown google.fr, and be done by Anonymous Coward · 2014-01-09 10:05 · Score: 0

Then french users can login to another countries google servers, get slower service and no longer legally accountable to the wackadoo french courts.
Just a cost of doing business by WillAffleckUW · 2014-01-09 12:02 · Score: 1, Insightful

So long as there are no jail terms for execs, and the penalties remain (and they are) a fraction of what they made, Google will keep doing this.
Remember what it says in the Google charter: "First, Be Evil".

--
-- Tigger warning: This post may contain tiggers! --
The french are known for this kind of BS by Anonymous Coward · 2014-01-09 13:19 · Score: 0

I have nothing against french people in general but politics in France is rather... Brutal. This was nothing more than an added tax on top of their insanely high taxes, which are possibly the highest in the world already? I don't even think there's a Google France office, so I'd assume that France could in theory sue just about every website out there, but I guess the reason being is that google owns a .fr domain and maybe they have to obey their stupid french rules. Ah well, this gives more reason for businesses to avoid France if there weren't enough reasons already.
1. Re:The french are known for this kind of BS by Sudline · 2014-01-09 19:00 · Score: 1
  
  Actually there is a French Office, off course.
2. Re:The french are known for this kind of BS by robsku · 2014-01-20 20:59 · Score: 1
  
  Yeah, I'm sure google will be storming out of france as quick as all other us:ian megacorporations are... wait, what? They aren't... well, boo-hoo.
  
  --
  In capitalist USA corporations control the government.
The French government knows... by BringsApples · 2014-01-09 13:46 · Score: 0

...so why not they tell The People (the users), exactly how their data is being used?

--
Politics; n. : A religion whereby man is god.
Google "complied"... by Anonymous Coward · 2014-01-09 19:42 · Score: 0

Google "complied" by displaying a link in a tiny font at the very bottom of the screen where no one will see it. I myself only spotted it because after I read this article I was looking for it.
150k EUR? Meaningless gesture by Anonymous Coward · 2014-01-10 01:14 · Score: 0

Bah. Means nothing, zero impact. A trivial amount of money to any successful tech company, let alone one of the biggest in the world. I'm sure Google execs wipe their asses with twice that amount of cash every day.
Ouch by easyTree · 2014-01-10 22:42 · Score: 1

Someone at google HQ won't be having dessert with their lunch today.

--
Requiem for the American Dream