Article written by Haim Ravia, Dotan Hammer and Adi Shoval
France’s Supreme Administrative Court, the Council of State, dismissed Google’s appeal on the 50 million Euro fine imposed by the French Data Protection Authority (the “CNIL”) for GDPR violations.
In early 2019, following an investigation against Google, the CNIL announced that that the Internet giant violated the GDPR by not obtaining proper consent from data subjects for using their information for targeted advertising and by not satisfying the GDPR’s requirement for transparency concerning the purpose of processing and data retention period.
In dismissing Google’s the French supreme administrative court confirmed that Google had provided data subjects with incomplete information, in particular regarding the data retention period and the purposes of the various processing operations. The court also found that the 50 million Euro fine is not excessive given the nature of the violations, their effects on users, the continuous nature of these breaches, the duration of the period during which they persisted, and Google’s financial situation
In response to the court’s decision, Google stated that it will make the proper changes to comply with the consent mechanism required by the GDPR, which requires affirmative consent (opt-in), rather than consent implied by acquiescence (opt-out).
CLICK HERE to read the Council of State’s decision (in French).
