Slashdot Mirror
Google Fined $57 Million By French Data Privacy Body For Failing To Comply With EU's GDPR Regulations (venturebeat.com)
schwit1 shares a report from VentureBeat: Google has been hit by a $57 million fine by French data privacy body CNIL (National Data Protection Commission) for failure to comply with the EU's General Data Protection Regulation (GDPR) regulations. The CNIL said that it was fining Google for "lack of transparency, inadequate information and lack of valid consent regarding the ads personalization," according to a press release issued by the organization. The news was first reported by the AFP. What the CNIL is effectively referencing here is dark pattern design, which attempts to encourage users into accepting terms by guiding their choices through the design and layout of the interface. This is something that Facebook has often done too, as it has sought to garner user consent for new features or T&Cs.
It's worth noting here that Google has faced considerable pressure from the EU on a number of fronts over the way it carries out business. Back in July, it was hit with a record $5 billion fine in an Android antitrust case, though it is currently appealing that. A few months back, Google overhauled its Android business model in Europe, electing to charge Android device makers a licensing fee to preinstall its apps in Europe. Google hasn't confirmed what its next steps will be, but it will likely appeal the decision as it has done with other fines. "People expect high standards of transparency and control from us," a Google spokesperson told VentureBeat. "We're deeply committed to meeting those expectations and the consent requirements of the GDPR. We're studying the decision to determine our next steps."
It's worth noting here that Google has faced considerable pressure from the EU on a number of fronts over the way it carries out business. Back in July, it was hit with a record $5 billion fine in an Android antitrust case, though it is currently appealing that. A few months back, Google overhauled its Android business model in Europe, electing to charge Android device makers a licensing fee to preinstall its apps in Europe. Google hasn't confirmed what its next steps will be, but it will likely appeal the decision as it has done with other fines. "People expect high standards of transparency and control from us," a Google spokesperson told VentureBeat. "We're deeply committed to meeting those expectations and the consent requirements of the GDPR. We're studying the decision to determine our next steps."
Vast amounts of new wealth has to be taxed
A fine for violating a law with a 2-year grace period is not a tax, stupid.
If it's an EU rule then why... Is a specific country fining Google?
Because the EU is a confederation, in which the EP and EC draft the rules, and then each member is tasked with enforcing them on their territory, which is an obligation they have accepted by ratifying the EU treaties.
it is really simple and straightforward.
You obviously have no idea. IP's are "personal information": https://www.alstonprivacy.com/... ; A website by definition serves anyone on the internet ; The rest of your post is likewise red herrings, GDPR is not concerned with whether or not an individual is an EU citizen, anyone located in an EU country is protected by GDPR and can apply for the protections under it. According to one law firm that tries to explain it: "it is likely that EU citizens residing in the US will be given the same protections as those living in an EU country". If you operate a hotel, how would you limit your offers, the goal is to sell yourself to as much visitors as possible, not serving people from the EU would be discrimination in many countries.
Custom electronics and digital signage for your business: www.evcircuits.com
You obviously have no idea. IP's are "personal information": https:
Wrong, it is you who has no idea. And let me quote the relevant part of the decision for you:
However, the ECJ did not state that in all cases, IP addresses in the hands of a website operator should be considered personal data. Instead, it required an evaluation of “whether the possibility to combine a dynamic IP address with the additional data held by the [ISP] constitutes a means likely reasonably to be used to identify the data subject.”
GDPR is not concerned with whether or not an individual is an EU citizen, anyone located in an EU country is protected by GDPR and can apply for the protections under it.
Wrong, only legal residents of the EU are protected by GDPR. Clearly stated in the law, which you have not read.
According to one law firm
Well, find a competent one, or just read the guides that EU has helpfully posted for more than 2 years now.
If you operate a hotel, how would you limit your offers
Well, you just advertise locally, or if you want orders from within the EU, you comply.
NO THEY FUCKING DON'T need a DPO. The regulations are quite clear on that, only organisations that process large scale data processing and collecting. You don't have any "hours to react to a breach", you have to act in a timely and responsible manner. NO your country DOES NOT mandate recording information in breach of the GDPR, The GDPR excludes government requirements for data storage, what it mandates is that you must store and process data in a responsible manner.