On May 28 2018, La Quadrature du Net, on behalf of 12 000 people, filed five complaints before the CNIL (the French Data Protection Authority) against Google, Apple, Facebook, Amazon and Microsoft. In the meantime, the CNIL decided it was qualified to handle the complaint against Google, while other complaints were directed before the Irish and Luxembourg authorities. Another complaint was submitted before the CNIL against Android by our friends of the Austrian association noyb.
Today, the CNIL sanctioned Google to a 50 million Euros fine, stating that the targeted advertising it engages in with its operating system Android is in breach of the GDPR, the new European regulation that came into effect on May 25. However, this sanction is really only the beginning of an answer to our complaint against Google, which denounced especially the targeted advertising imposed on Youtube, Gmail and Google Search in violation of our consent.
In this respect, the CNIL explains the low amount of its sanction, considering Google’s nearly 110 billion US dollars revenue, by the fact it limited the scope of its examination to “the data processing covered by the privacy policy presented to a user when creating their account on their Android mobile phone” (our translation). 1« les traitements couverts par la politique de confidentialité présentée à l’utilisateur lors de la création de son compte à l’occasion de la configuration de son téléphone mobile sous Android », paragraph 78 of the CNIL’s published decision. We therefore expect the CNIL to quickly answer the rest of our complaint, which concerns Youtube, Gmail and Google Search, by issuing a fine commensurate with this company and the extent and the duration of the violation of ours rights (the maximum amount possible is 4 billion euros – 4% of global revenue –, which we hope for).
Furthermore, regarding the substance of the decision, the CNIL has sanctioned Android on the basis of rather low-stake arguments: it considers, rightly, that the information Google provides when creating an account is not clearly accessible and that our consent is not explicitly obtained (with a positive act on our part) but, notably, using pre-ticked boxes, which is explicitly prohibited by the GDPR.
Admittedly, this last argument was indeed one of those we raised in our complaints, but our complaints were primarily intended to settle another, much more fundamental debate: for the CNIL to recognise that our consent is only valid when it is freely given . For the CNIL to clearly state that Google can not force us to accept its targeted advertising in order to use its services.
In contrast to the its recent decisions about French companies, the CNIL is today fully silent on this subject, which we deeply regret. We expect these issues will be addressed in its forthcoming decisions about Youtube, Gmail and Google Search.
Incidentally, however, it should be noted that Google, during the instruction, claimed that it systematically requires our consent to target us for advertising, and did not rely on other legal basis (such as a “legitimate interest”). These claims are interesting, first because they contradict the contents of the Google’s privacy policy (which claim to be able to target us without our consent) but also because it suggests a possible strategic retreat on Google’s part who, its back to the wall, could have no choice but to finally stop feigning completely ignoring European law.
One major concern remains: to escape these kind of decisions, Google recently modified its terms of use. According to these, from the 22 January 2019, the company will be established in Ireland in the hope of preventing the French CNIL from taking decisions such as today’s (as the Irish authority is under-staffed and drowning in complaints, Google can hope to slow down the proceeding for years). We expect the CNIL to ignore this shameless pirouette and decide that it is still competent to pronounce other sanctions against Youtube, Gmail and Google Search, our complaint having been filed long before this unilateral change in the terms of use imposed by Google.
In conclusion, while we welcome this first sanction based on our collective complaints, especially because this decision cuts short Google’s attempted escape to Ireland, we mainly expect from the CNIL to issue as soon as possible its next decisions. These will have to address the issue of “freely given consent” and provide for a sanction that is proportionate to the situation, well beyond 50 million euros.
Lastly, we would like to extend a warm thank you to the 12 000 people with whom we lodged these complaints against the GAFAM and the world they stand for <3
References
| ↑1 | « les traitements couverts par la politique de confidentialité présentée à l’utilisateur lors de la création de son compte à l’occasion de la configuration de son téléphone mobile sous Android », paragraph 78 of the CNIL’s published decision. |
|---|