Google to appeal record breaking data privacy fine

Following our blog on 22 January 2019 on the record breaking fine issued to Google by the French data protection watchdog, CNIL, for breaching the requirements of the General Data Protection Regulation (GDPR), Google has now confirmed that it intends to appeal the €50 million fine.

Reasons for the appeal

In a statement confirming its intention to appeal, Google stated that they have “…worked hard to create a GDPR consent process for personalised ads that is as transparent and straightforward as possible, based on regulatory guidance and user experience testing.

“We’re also concerned about the impact of this ruling on publishers, original content creators and tech companies in Europe and beyond. For all these reasons, we’ve now decided to appeal”.

Notably, Google isn’t the only organisation to have raised concerns regarding the potential impact of the decision. Alex Stamos, former chief security officer of Facebook took to Twitter to air his concern that finding a European advertiser who lives up to the standards set by GDPR is difficult and that “…if CNIL doesn’t fine any EU-based ad networks in the coming months we know GDPR is about competition policy, not privacy”.

Will Google win?

Part of the CNIL decision relates to Google not having a legal basis for processing data in connection with personalised advertising. Google sought to rely on the consent of the user to justify using personal data for this purpose.

The GDPR has introduced a very high bar for consent, specifying that it has to be ‘…given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement…’. In our experience this is difficult to achieve and can be incompatible or difficult to reconcile with offering a frictionless user experience. It is likely that Google has fallen short of this requirement by disseminating information relating to the use of data across multiple documents, as this is unlikely to be enough to demonstrate unambiguous and informed consent. Further, the use of pre-ticked boxes would not constitute an affirmative action as is required for GDPR level consent.

Google’s appeal will be heard by Conseil d’Etat and is the first substantial case to be centred on the new data protection law. Consequently, it is likely to provide a degree of clarity to some of the more ambiguous parts of the GDPR, for example what level of transparency is required in practice to meet the requirements set out within the GDPR.

If you wish to discuss this topic further or have any other questions, please contact Nick Philips, James Davey, or any member of the Edwin Coe Intellectual Property team.

Please note that this blog is provided for general information only. It is not intended to amount to advice on which you should rely. You must obtain professional or specialist advice before taking, or refraining from, any action on the basis of the content of this blog.

Edwin Coe LLP is a Limited Liability Partnership, registered in England & Wales (No.OC326366). The Firm is authorised and regulated by the Solicitors Regulation Authority. A list of members of the LLP is available for inspection at our registered office address: 2 Stone Buildings, Lincoln’s Inn, London, WC2A 3TH. “Partner” denotes a member of the LLP or an employee or consultant with the equivalent standing.

Please also see a copy of our terms of use here in respect of our website which apply also to all of our blogs.