Following our blog on 22 January 2019 on the record breaking fine issued to Google by the French data protection watchdog, CNIL, for breaching the requirements of the General Data Protection Regulation (GDPR), Google has now confirmed that it intends to appeal the €50 million fine.
Reasons for the appeal
In a statement confirming its intention to appeal, Google stated that they have “…worked hard to create a GDPR consent process for personalised ads that is as transparent and straightforward as possible, based on regulatory guidance and user experience testing.
“We’re also concerned about the impact of this ruling on publishers, original content creators and tech companies in Europe and beyond. For all these reasons, we’ve now decided to appeal”.
Notably, Google isn’t the only organisation to have raised concerns regarding the potential impact of the decision. Alex Stamos, former chief security officer of Facebook took to Twitter to air his concern that finding a European advertiser who lives up to the standards set by GDPR is difficult and that “…if CNIL doesn’t fine any EU-based ad networks in the coming months we know GDPR is about competition policy, not privacy”.
Will Google win?
Part of the CNIL decision relates to Google not having a legal basis for processing data in connection with personalised advertising. Google sought to rely on the consent of the user to justify using personal data for this purpose.
The GDPR has introduced a very high bar for consent, specifying that it has to be ‘…given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement…’. In our experience this is difficult to achieve and can be incompatible or difficult to reconcile with offering a frictionless user experience. It is likely that Google has fallen short of this requirement by disseminating information relating to the use of data across multiple documents, as this is unlikely to be enough to demonstrate unambiguous and informed consent. Further, the use of pre-ticked boxes would not constitute an affirmative action as is required for GDPR level consent.
Google’s appeal will be heard by Conseil d’Etat and is the first substantial case to be centred on the new data protection law. Consequently, it is likely to provide a degree of clarity to some of the more ambiguous parts of the GDPR, for example what level of transparency is required in practice to meet the requirements set out within the GDPR.
Edwin Coe LLP is a Limited Liability Partnership, registered in England & Wales (No.OC326366). The Firm is authorised and regulated by the Solicitors Regulation Authority. A list of members of the LLP is available for inspection at our registered office address: 2 Stone Buildings, Lincoln’s Inn, London, WC2A 3TH. “Partner” denotes a member of the LLP or an employee or consultant with the equivalent standing.