Google Fined $57 Million By French Data Privacy Body For Failing To Comply With EU's GDPR Regulations (venturebeat.com)

schwit1 shares a report from VentureBeat: Google has been hit by a $57 million fine by French data privacy body CNIL (National Data Protection Commission) for failure to comply with the EU's General Data Protection Regulation (GDPR) regulations. The CNIL said that it was fining Google for "lack of transparency, inadequate information and lack of valid consent regarding the ads personalization," according to a press release issued by the organization. The news was first reported by the AFP. What the CNIL is effectively referencing here is dark pattern design, which attempts to encourage users into accepting terms by guiding their choices through the design and layout of the interface. This is something that Facebook has often done too, as it has sought to garner user consent for new features or T&Cs.

It's worth noting here that Google has faced considerable pressure from the EU on a number of fronts over the way it carries out business. Back in July, it was hit with a record $5 billion fine in an Android antitrust case, though it is currently appealing that. A few months back, Google overhauled its Android business model in Europe, electing to charge Android device makers a licensing fee to preinstall its apps in Europe. Google hasn't confirmed what its next steps will be, but it will likely appeal the decision as it has done with other fines. "People expect high standards of transparency and control from us," a Google spokesperson told VentureBeat. "We're deeply committed to meeting those expectations and the consent requirements of the GDPR. We're studying the decision to determine our next steps."

Comments

Speeding fine

[Anonymous Coward]

Based on that, my next speeding fine should be about $0.27

Corporate fines MUST be based on International turnover (they hide profits too well), or better year a minimum of 12 months in federal prison for all of the Management.

Re: Speeding fine

[Mr. Dollar Ton]

GDPR's sole reason to exist is to give me a legal option to force the likes of Facebook and Google to store and process my private information in a more responsible manner.

It is not difficult to comply with. A Mom and Pop shop does't need "a full time DPO" if they have a visitor from the EU or ship a package occasionally.

I looked at europa.eu, and I don't understand what you mean at all by "cleaning house domestically". The GDPR applies with the same strength everywhere in the EU, and to all companies that operate there. I've had personal data removed by EU companies after a GDPR request.

Take a breather, nobody's buying your sad FUD.

Re: Speeding fine

[Cederic]

The EU hasn't set a rule on companies. The EU has agreed collectively that its member states must pass rules on company behaviour.

The benefit of the EU is that complying with one country's rules means you're (broadly) automatically complying with all of the other countries' rules. You still have to obey the law in each country in which you operate.

Is that so hard to comprehend?

Re: Speeding fine

[kaur]

GDPR is very simple to comply with:
- know how your business uses personal data
- be open about it - inform your customers
- secure the use of personal data by access control & logging
- check your contracts with third parties, and try not to share personal data unless necessary
- educate your employees

That's about it.

The real effect of GDPR is implementing reasonable data management practices across the board.
Say I want to save the hair colour of customers. Shall I create a new database? Or should I put it into an existing one? New database is easier, I don't need to discuss with anyone, I'l just spin up a new mongo instance, done. But I'll lack all security that the old database already has. Now GDPR forces me to implement security, which means it will be easier to put the data into the existing DB, even if this has management overhead for me - I need to get my change into DB team's backlog, etc. However, in the long run I am better off with all data being in one place, not split across multiple platforms.

Or say I need to email / message / call my customers. GDPR incentivizes using service providers that have been already set up, with contracts and security and compliance in place. This is a price to pay, you won't be as flexible as you could, and you will pay extra for the compliance. However, this is a reasonable tradeoff.

Mom & Pop should thus know what personal data they have, know how they handle it, and say it out in a public statement.
Not much to ask.

Re:Offer them an alternative

[Mr. Dollar Ton]

Tax avoidance is something entirely different from non-compliance with the privacy law. Why would you want to mix the two?

Re: How France understands computer use

[Maelwryth]

It's a fine, not a tax. If Google wishes to operate within the E.U. then they have to obey the laws of the E.U.

Re: How France understands computer use

[Freischutz]

Well that's easy then pull out of all EU countries and find out who begs who back first.

Yeah, go back to California to sulk and leave a market of 500 million potential customers to your competitors that you have poured considerable efforts and money into making sure remain 3rd rate players with marginal market share so they won't threaten your monopoly. On what level does that seem like an intelligent plan to you? Google is about as likely to abandon the EU market as a pig is likely to voluntarily move out of a field of clover.