Slashdot Mirror
Google Fined $57 Million By French Data Privacy Body For Failing To Comply With EU's GDPR Regulations (venturebeat.com)
schwit1 shares a report from VentureBeat: Google has been hit by a $57 million fine by French data privacy body CNIL (National Data Protection Commission) for failure to comply with the EU's General Data Protection Regulation (GDPR) regulations. The CNIL said that it was fining Google for "lack of transparency, inadequate information and lack of valid consent regarding the ads personalization," according to a press release issued by the organization. The news was first reported by the AFP. What the CNIL is effectively referencing here is dark pattern design, which attempts to encourage users into accepting terms by guiding their choices through the design and layout of the interface. This is something that Facebook has often done too, as it has sought to garner user consent for new features or T&Cs.
It's worth noting here that Google has faced considerable pressure from the EU on a number of fronts over the way it carries out business. Back in July, it was hit with a record $5 billion fine in an Android antitrust case, though it is currently appealing that. A few months back, Google overhauled its Android business model in Europe, electing to charge Android device makers a licensing fee to preinstall its apps in Europe. Google hasn't confirmed what its next steps will be, but it will likely appeal the decision as it has done with other fines. "People expect high standards of transparency and control from us," a Google spokesperson told VentureBeat. "We're deeply committed to meeting those expectations and the consent requirements of the GDPR. We're studying the decision to determine our next steps."
It's worth noting here that Google has faced considerable pressure from the EU on a number of fronts over the way it carries out business. Back in July, it was hit with a record $5 billion fine in an Android antitrust case, though it is currently appealing that. A few months back, Google overhauled its Android business model in Europe, electing to charge Android device makers a licensing fee to preinstall its apps in Europe. Google hasn't confirmed what its next steps will be, but it will likely appeal the decision as it has done with other fines. "People expect high standards of transparency and control from us," a Google spokesperson told VentureBeat. "We're deeply committed to meeting those expectations and the consent requirements of the GDPR. We're studying the decision to determine our next steps."
Based on that, my next speeding fine should be about $0.27
Corporate fines MUST be based on International turnover (they hide profits too well), or better year a minimum of 12 months in federal prison for all of the Management.
I'm guessing Google will send some low level admin person to check between the cushions of the couches in the office to pay this.
Vast amounts of new wealth has to be taxed
A fine for violating a law with a 2-year grace period is not a tax, stupid.
Except that France is not taxing them, but is applying a fine for non-compliance with french data protection laws. If you do business in a country, you have to be prepared to comply with local laws or else pay the penalties that arise.
Even Google agrees with that premise, at least in their official statement.
Like, say, they could pay the taxes for the revenue they make in France instead of squirreling it away with some tax evasion tricks.
Then again, paying the fine is probably cheaper.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
What a load of crock. Logging IPs is not even covered by the GDPR, only collecting personal information is. A website has to comply only if it serves EU residents. If you employ people "from the EU" that are legal residents of a non-EU country, GDPR does not apply to them. If you apply EU residents, you obviously employ them in the EU, so you have to comply with all of the EU legislation, not just GDPR. If you operate a hotel, you're liable only if you sell your offers within the EU.
No, when a government gets to spend money it is a disbursement from the government budget. A tax is an amount collected from a group of citizens that support the operation of their government. A fine is a measure to discourage criminal behavior, by a person or a corporation.
Get the reasons for the different definitions, just being loud and ignorant doesn't strengthen your argument.
You don't know much about GDPR (proof: https://slashdot.org/comments....) so your opinion as to whether it is oppressive or protectionist is completely irrelevant.
If it's an EU rule then why... Is a specific country fining Google?
Because the EU is a confederation, in which the EP and EC draft the rules, and then each member is tasked with enforcing them on their territory, which is an obligation they have accepted by ratifying the EU treaties.
it is really simple and straightforward.
You obviously have no idea. IP's are "personal information": https://www.alstonprivacy.com/... ; A website by definition serves anyone on the internet ; The rest of your post is likewise red herrings, GDPR is not concerned with whether or not an individual is an EU citizen, anyone located in an EU country is protected by GDPR and can apply for the protections under it. According to one law firm that tries to explain it: "it is likely that EU citizens residing in the US will be given the same protections as those living in an EU country". If you operate a hotel, how would you limit your offers, the goal is to sell yourself to as much visitors as possible, not serving people from the EU would be discrimination in many countries.
Custom electronics and digital signage for your business: www.evcircuits.com
It's a fine, not a tax. If Google wishes to operate within the E.U. then they have to obey the laws of the E.U.
I reserve the write to mangle english.
You obviously have no idea. IP's are "personal information": https:
Wrong, it is you who has no idea. And let me quote the relevant part of the decision for you:
However, the ECJ did not state that in all cases, IP addresses in the hands of a website operator should be considered personal data. Instead, it required an evaluation of “whether the possibility to combine a dynamic IP address with the additional data held by the [ISP] constitutes a means likely reasonably to be used to identify the data subject.”
GDPR is not concerned with whether or not an individual is an EU citizen, anyone located in an EU country is protected by GDPR and can apply for the protections under it.
Wrong, only legal residents of the EU are protected by GDPR. Clearly stated in the law, which you have not read.
According to one law firm
Well, find a competent one, or just read the guides that EU has helpfully posted for more than 2 years now.
If you operate a hotel, how would you limit your offers
Well, you just advertise locally, or if you want orders from within the EU, you comply.
Do you say the same when it comes to China or North Korea? Oppressive, protectionist laws are equally oppressive regardless of the current regime.
I certainly do, if the regime is Oppressive and you disagree then don't do business there. Businesses do not and should not EVER get to select which laws they will and will not obey.
As an EU citizen, albeit for another two and bit months, I don't find these laws oppressive in any kind of way and I'm glad that a level government that represents me is doing something to protect my interests and privacy. Somebody's had to reign these corporations in and the US government has shown no leadership in this area. Put it down to a failed experiment with a new business model and expect companies to adapt or fail. I won't cry if Google and Facebook fail and go the way of the likes of Yahoo Search and My Space.
*THIS*. People lose sight of the fact that EU law doesn't apply outside the EU. Outside the EU includes companies that have no presence in the EU.
That hysteria from some random mom and pop shop having their website visited by someone in the EU was just that: dumb hysteria. If you want to do actual business in the EU then comply with EU law. If you don't then you rightly have nothing to fear.
Well that's easy then pull out of all EU countries and find out who begs who back first.
Yeah, go back to California to sulk and leave a market of 500 million potential customers to your competitors that you have poured considerable efforts and money into making sure remain 3rd rate players with marginal market share so they won't threaten your monopoly. On what level does that seem like an intelligent plan to you? Google is about as likely to abandon the EU market as a pig is likely to voluntarily move out of a field of clover.
I have never seen any company that is so aggressive in denying customers their rights under the GDPR. When is the ban or fine coming? It's been taking too long already.
It means exactly what is says - that an IP address is not "personally identifiable information" (which, incidentally, is what the law says, too) except in very rare circumstances.
What you describe (linking an IP address and the data that come from it) is nonsense, because even if you have some data that you can connect to a dynamic IP, you cannot be certain that a second connection over that IP will be by the same person based on the IP number only.
Complaining about the GDPR without haven't even read the law produces a crock of badly written shit constructed by people who neither know nor care about what they're doing.
Theoretically, the EU can ask a foreign court to apply the fines if there are relevant treaties in place (the US does this quite often, sending extradition requests left and right, for example). In practice, yeah, it is irrelevant for practically everyone operating outside of the EU.
A law that is designed so literally nobody understands or can comply with.
So like every other law then.
Still, it's amazing how many companies are managing to comply with this one. It's also amazing how much leeway regulators will give you if they feel you're in breach of it, especially inadvertently.
Virtually any collection of data is liable under GDPR -worldwide-
Only if you're operating or interacting with someone in the EU.
serve an EU citizen in your hotel, liable
Oh please. I'm typing this from a hotel in Florida that under EU law I could put out of business in a week, their management practices are so scummy. Luckily for them they're in Florida where consumer protections are fuck all.
Yeah, I'm leaving them some seriously abusive reviews on online sites. No, I'm not going to try and make them comply with EU law because - unlike you - I know it doesn't apply here.
It's always ACs posting bulllshit about GDPR and claiming its protectionism.
This stinks of a disinformation campaign.
GDPR applies to everybody. It does not target foreign countries.
EU based companies are required to comply with data protection.
EU based companies are prosecuted for failing to comply with data protection.
US and other companies are also prosecuted for failing to comply with data protection.
To avoid prosecution under this law stop fucking break it.
To avoid prosecution for misusing consumer data, stop fucking abusing consumers.
The EU has been doing kangaroo courts
Where? When? Show us all where there's a fucking EU court that hasn't followed due process and has ruled against EU law.
If you look at europa.eu and court verdicts, they never clean their own house.
Nobody ever looks at europa.eu. As for court verdicts, most cases never even get to court. In the UK for instance, the ICO issues legally binding fines without needing to use courts, because the law is pretty fucking clear.
If Google were a German company, it could sell what it felt like, and never see the scrutiny of officials.
Given that Germany's first fine issued under GDPR was against a German company you're looking pretty fucking stupid.
The EU is just doing a very simple tactic. Xenophobia.
Consumer protection applied consistently across companies from anywhere on the planet - including the EU - is now xenophobia? Someone buy this cunt a dictionary.
The GDPR is just a trade war tool, because few European companies deal in data control
Almost every fucking European company deals in data control. Most businesses these days are IT companies with a sideline in manufacturing, retail or something less tangible.
it is crafted explicitly as a bill of attainder, which in more civilized countries is illegal
Just because your shitty business practices are made illegal by the law doesn't make it a bill of attainder. It only criminalises people that refuse to respect and protect the data they hold on others.
Stop being a cunt and you wont be breaking the law. Simples.
Theoretically, the EU can ask a foreign court to apply the fines
They can ask foreign courts a lot of things. In practice the only time this works is if courts determine if the fine is legitimate. In practice even the GDPR legislation recognises the difference between doing business in the EU and just having some random person visiting your site incidentally. I can directly buy something from someone outside the EU just fine and they still wouldn't necessarily need to comply with the GDPR.
Like many other GDPR "critics" on /., you don't understand the basic ideas of GDPR because you have not read the law.
So, let me explain it to you in simple terms.
GDPR regulates *personally identifiable information* that someone who is a legal resident of the EU has shared with you. If someone just visits your website and does not leave any personally identifiable information with you, then you cannot identify them, and you have no obligations under GDPR, even if you collect their IP address. This is all there is to say about IP addresses as a GDPR issue.
If you have collected and processed information from a legal resident of the EU, information that you can identify them with, things like national ID, name, address, credit card or bank info, whatever, you have obligations under GDPR. They are very simple and straightforward.
You must keep the information safe, keep only what you need to deliver the service you're providing, explain what you are keeping and why in a simple language, explain how it is used with specifics, and let the person edit it if it is no longer relevant and remove it if it is no longer necessary, or if the user asks you to do so and you don't have a good reason to refuse.
That's all.
How about you read the law text itself for a change?
Here, let me post the relevant parts for you:
"‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;"
"The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. 6This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes."
The only time when an IP address is a *personally identifiable information* is when "Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them."
So, just an IP address by itself is definitely not personally identifiable information, and that is what the law says on the matter.
If that where not the case, AB InBev, the largest brewer in the world, Heineken an Carlsberg would be selling beer to 16 year olds, like they do in their home counties in the US.
Don't fight for your country, if your country does not fight for you.
it's a negotiating tactic. Because at this point when corporations (our defacto Ruling Class) break the law we have to negotiate with them to see how much of the law they will follow. Like a peasant begging it's king for relief.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Yeah, kinda sad.
GDPR states that you are liable even if you are a foreign entity. Kind of like the US laws apply abroad to US citizens.
Custom electronics and digital signage for your business: www.evcircuits.com
The GDPR law together with various treaties like the ones on copyright, make sure that those laws in the EU apply to US companies... like Google and Facebook too.
There is a reason so many US companies are worried about GDPR compliance - it applies to anyone interacting with any EU resident or presence, through the Internet, this means worldwide.
Custom electronics and digital signage for your business: www.evcircuits.com
Pulling out doesn't mean blocking access to all EU IP addresses. It means shutting down EU subsidiaries, at most. ISPs would then have to decide whether to block google.com or not, but, good luck with that, given how many third party websites load things from Google servers.
The idea that the EU market is so large the EU can pull whatever nonsense it likes is probably going to be tested severely in the coming years. It looks increasingly like a lawless place - GDPR is a classic example of a law that says nothing and everything simultaneously, in which enforcement is entirely political. But there are many other such laws. The idea that the EU is a fair and predictable place to do business is increasingly stressed, and there are plenty of ways to make money from people in it without needing to follow EU law, no more than everyone in Europe has to follow every aspecft of US law to sell products to it successfully.
those laws in the EU apply to US companies... like Google and Facebook too
Of course they fucking do. Google and Facebook (and other US companies) do business in Europe. It's not fucking unreasonable to expect them to obey the same laws applied to other companies doing business in Europe, including the ones based there.
The alternative is that you only ever hold a company accountable to the laws in the country in which it is registered, in which case watch every fucking company on the planet get registered in some African shithole that eliminates all controls and regulations on corporations.
You might not have a problem with that but I fucking promise you the US government would.
Stop lying, GDPR is nothing like that. GDPR states that you have obligations under it if you serve EU residents within the EU. That is, you do business within the EU. If I go to Japan, and pick a hotel there to stay, GDPR does not apply at all and has nothing to say about it.
Pulling out doesn't mean blocking access to all EU IP addresses. It means shutting down EU subsidiaries, at most. ISPs would then have to decide whether to block google.com or not, but, good luck with that, given how many third party websites load things from Google servers.
The idea that the EU market is so large the EU can pull whatever nonsense it likes is probably going to be tested severely in the coming years. It looks increasingly like a lawless place - GDPR is a classic example of a law that says nothing and everything simultaneously, in which enforcement is entirely political. But there are many other such laws. The idea that the EU is a fair and predictable place to do business is increasingly stressed, and there are plenty of ways to make money from people in it without needing to follow EU law, no more than everyone in Europe has to follow every aspecft of US law to sell products to it successfully.
If Google is willing to bend over and spread'em to stay in the Chinese market then they are not about to pull out of the EU. Also, Google abandoning a market the size of the EU will basically create a protected reservation, a huge market where competitors can grow that one day might threaten Google. Then there is the fact that the EU much like the US is a very wealthy area and consistently delivers high level of profits for Google. The idea that Google will abandon the EU and go back to California to sulk is about as stupid as the idea that Europe will grind to a halt and devolve into a bronze age society because of an absence of Google. The only thing that will happen if Google goes away will be the same thing that happened when the Dinosaurs went away, the little furry critters living in the holes under the tree roots evolved into big critters with long sharp claws and fangs or pointy horns so please read the following and commit it to memory: GOOGLE will never abandon the EU market and go back to California to sulk!!!