Google Inc. fined by the CNIL

A Euro 150 000 fine was imposed by the French National Commission on Informatics and Liberties (CNIL) on Google Inc., whose corporate headquarters are located at Mountain View, California in the United States of America.

On January 24th, 2012 Google announced its intention to unify the privacy policies of about 60 of its free services (YouTube, Gmail, Google Drive, etc.) in order to simplify them, which it did.

The Working Party on the protection of individuals with regard to the processing of personal data, known as Article 29 Working Party, decided to evaluate the impact of Moutain View's giant's unification plan.

Article 29 Working Party was concerned about the processing and the content of the data collected, namely:

- risks of profiling, a practice by which Google Inc. merges all the data collected into a profile to target advertisements;

- the opportunity to ascertain with great precision the behavior of users on the Internet;

- risks of accessing and processing data of recipients: when a Gmail user sends an email its content is scanned by Gmail to send to the recipient targeted advertisement.

After discussions with Google Inc., Article 29 Working Party concluded that the project didn't respect the requirements set by Directive 95/46/EC of 24th October, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

A letter signed by 27 authorities composing Article 29 Working Party invited Google Inc. to implement a series of recommendations before the 15th of February, 2013. The suggestions formulated by Google Inc. in reply were deemed insufficient, and 6 European authorities, including the CNIL, initiated proceedings against Google Inc.

The proceedings initiated by the CNIL led the restricted formation to impose on Google a record fine.

After confirming its jurisdiction, which had been challenged by Google Inc., the CNIL considered that:

- information provided to users concerning the purpose and data processing were insufficient. Indeed, users were not able to exercise their rights, especially access, erasure of data, and right of rectification;

- Google didn't fulfill its obligations of securing prior consent from users before storing cookies on their computers;

- Google doesn't specify the duration of storage of processed data;

- andGoogle didn't secure the consent necessary for consolidating all the data collected by its services.

The CNIL's restricted formation ordered Google to post a notification on Google's French homepage of the CNIL's decision. The notification was posted on Saturday February the 8th, 2014.

This decision falls in with decisions handed down, at the end of 2013, by Spanish and Dutch data protection authorities.