Google isn’t having an easy time of it as data protection is tightening. Recently, the French Supreme Court of Administrative Law rejected Google’s claim that it had to pay a $57 million fine last year for failing to tell its users how to handle their personal information. On June 19, the French State Council officially released the trial results, confirming the previous investigation results of the data regulator CNIL, that Google did not provide Android users with “clear enough” information reminders. This means that it did not have lawful consent to use user data for specific advertising. Considering the seriousness and continuity of Google’s violations, the $57 million fine is also justified.
More importantly, the court also confirmed the French national regulatory authority’s jurisdiction over Google. Based on the GDPR regulations, the multi-million-dollar fines faced by Google are by far the highest fines against technology giants. This incident will also have a certain symbolic significance, mainly for those who think whether the GDPR can play the role.
This penalty seems insignificant relative to the global revenue of Google’s parent company Alphabet. Nevertheless, Google will make corresponding adjustments in the future. It will work on how to collect user data and its advertising positioning bottom line.
This case is not about obtaining permission, it’s about how to obtain it – Google
According to the GDPR, if the company uses the user’s personal data, it must obtain personal consent. That is to say, this cannot be mandatory. This is also the key basis for the decision of the French court.
A Google spokesperson issued the following statement in response to the decision of the French court: “People expect to understand and control how personal data is used. At present, we have invested in industry-leading tools to help achieve these two points. This case is not about whether advertising requires consent, but about how to obtain consent. According to this decision, Google will also review what other changes need to be made internally”.
In addition, the French digital rights organization La Quadrature du Net’s previous lawsuit against the estimate also announced the victory on the same day, which is the first in a series of sanctions that the GDPR represents on 12,000 citizens against the technology giant.
The spokesman said, “The remaining complaints against Google, Facebook, Apple and Microsoft are still being investigated in Ireland. Regardless of the results, this is the original intention of the GDPR and a commitment to the public.”