French data watchdog dishes out largest GDPR fine yet: Google ordered to hand over €50m Google has been fined a mammoth €50m by the French data protection watchdog for GDPR violations in a victory for Max Schrems' privacy group NOYB. The French agency, CNIL, ruled today that the search giant had offered users inadequate information, spreading it across multiple pages, and had failed to gain valid consent for ads …
I wonder what the lead-time for this sort of case is, and how many more are in the pipeline?
It's pretty clear to anyone who is familiar with the main points of GDPR that one of the "big boys" was going to fall foul of it sooner or later. Google was always a likely candidate since their business model is basically data collection.
This case as well as a few others were launched straight after GDPR came into force in Ma, so about 8 months.
All the info is on the NYOB website https://noyb.eu/ where it is also possible to donate to the cause of bringing privacy cases to court.
RFC822, aren't we forgetting your Windows laptop and your ipad.
To call people use paper cups with strings attached, to replace your phone and tablet use a mini chalkboard (I would go with a Pi, but then users would just load Facebook or Twitter and click accept on their ad preferences because they are deliberatly annoying to use).
Irony is that duckduckgo is heavily java script dependent, so if you run with JS disabled by default (as a basic security precaution) then duckduckgo will not work.
so, privacy at the cost of increased risk to security.
.. Too many sites use JS unnecessarily when there are non script alternative methods available.
I run it mostly without JS myself - most of the customisations I want to do that are JS-only GUI-wise can also be invoked via URL parameters or special search syntax as per my other post here:
https://forums.theregister.co.uk/forum/all/2019/01/21/google_50m_cnil_gdpr/#c_3699701
Irony is that duckduckgo is heavily java script dependent, so if you run with JS disabled by default (as a basic security precaution) then duckduckgo will not work.
Really? I never knew that. Works fine for me.
Too many sites use JS unnecessarily when there are non script alternative methods available.
On that we agree. There is very little need for JS on most sites, and most pages don't need it at all.
Fellow DDG users wishing to invoke a google search directly from DDG itself using !g as a search prefix:
https://duckduckgo.com/bang
https://duckduckgo.com/bang_lite.html (non-JS)
https://duck.co/help/results/syntax
https://duckduckgo.com/params (general URL parameters)
A Firefox plugin that adds a Google tab to DDG which you can hit if necessary is Privacy Labrador.
Yes finally they got caught but what's the point in the end?
"Under the law, it can award fines of up to €20m or 4 per cent of annual turnover – and it has wielded the new power with aplomb, handing out a €50m penalty"
Google's annual turnover is over $100 billion, so 50 million is less than 0.05% of turnover. I'm not sure if "annual turnover" under GDPR is global or local, but even if limited to the revenues of Google France it's likely to be a rounding error on their accounts.
jmch,
That was just France. Once one European data protection authority has ruled against you, the chances increase of the others doing so. And they can keep fining you if you don't come into compliance.
Companies can't keep paying multi-millions in fines.
Also they can be fined on a percentage of turnover. Google "only" made about $12.6 billion in profit in 2017, on that turnover of $111. So once the fines go into the millions, and start to add up, they'll really start to notice.
That's the cheap knock-off one from an Amazon seller with 125 excellent reviews in 2 days....I can't find him today...but there are 20 other sellers with the same item all getting great reviews today.
The real one says $111 profit on turnover of $12.6 billion.
These are funds for France, not the EU. I doubt whether a French company will ever be prosecuted.
Expect much more of this. Massive fines are designed to fill the coffers of the state, not to recompense the victims. Many countries are now using this for revenue, especially the USA.
Or just don't be too worried about it if you've got nothing to hide. You're going to see ads, so why not see the ones that are appropriate to you? Use your Android phone. Like using Chrome and having your extensions, history, autofill etc follow you to any device.
Or you could be really naive and think you'll get all these things for free with no company having a business model to make the money to support these services.
Ah the "nothing to hide so nothing to fear" crowd rears its naive head again. You do realize this isn't an all or nothing deal, right? You don't have to choose between giving up all privacy, or maintaining perfect privacy. There is plenty of room in the middle ground.
If Google didn't collect tons of personal information on you, they could still show ads that have to do with what you are searching for. If I search on "4k hdr tv" having a few sponsored links from Amazon, LG and Samsung to where you can buy or learn more information about their 4K TVs might be what I need. Certainly that's more likely to be useful in the moment than showing me a sponsored link for a place selling TItleist golf balls, based on an all knowing Google knowing I play golf and all my online purchases of golf balls have been Titleist.
The problem is they want to sell ads all over the internet, and want ads for 4K TVs and golf balls to follow me across the internet whether I'm reading news about GDPR fines or looking up information on wifi 6. And it may help make their mostly useless assistant technology slightly less useless. For those who are filled with horror that Google's assistant might end up dumbed down to Siri's level if they only knew as much about you as Apple does, you can always volunteer to shed your privacy if a moment's convenience is worth more to you.
Just give people the choice, you "nothing to hide" people can give Google full access to your medical history for all I care, and have ads advertising a discount lobotomy follow you across the internet.
Or just don't be too worried about it if you've got nothing to hide.
I do have stuff to hide though. Who is in my bed tonight belongs only between the 5 of us. Same for who is over for dinner.
What we discuss is our business, no one else's. It might be garbage about some crappy TV show, but one of us might have a health issue or relationship issues or be looking for largely unvisited plots of land locally and cheap disposable shovels. That's our business, not yours and not Googles. Where and when I travel is also something I wish to keep private. Not your business unless you're paying me, it's your vehicle, or you're with me.
If I chose to tell you something, it's still none of your business unless you become involved, and whatever I tell you is no one else's business unless I specifically tell you it's OK to share it with others, even if more than one person are present when I tell you.
This stuff is so simple. I despair for our race when so many have so much trouble with such simple concepts!
That's fine - interest will be added. And the options of appeal under GDPR are relatively limited. You would have to prove the local DPR made an error in law.
Sort of.
You'd have to assert the local DPR made an error in law. Proving it is unneccessary for the delay.
Interest may be added, but that will always likely be lower than the investment gains Google will make by delaying payment (It's how pretty much every insurance company operates).
That assumes, and I realise how manifestly out of order this will sound, that google can't pull an Uber and use customer pressure to force a different result. I'm specifically thinking about how Mayor Khan folded in the face of stranded Millennials who presumably were the ones that voted for him, granting Uber a licence to resume operations having changed.... well, I'm not quite sure what.
Uber were always going to get their license back. They just had to sign up to the stuff they hadn't been doing before, like passing on criminal accusations made about their drivers to police. It's not like the requirements were particularly onerous or anything.
This is rather different. The law isn't on Google's side in this case. They'll appeal I'm sure, but they'll lose. And eventually they'll have to change their behaviour or pull out of the EU marketplace - which they won'to do because the profits are lovely.
I'm sure they'll up their spend on lobbying, but it's too late, the GDPR is passed. And the EU is very slow to re-write laws - because it takes so long to agree them in the first place. The GDPR will take well over a decade to change, if there was the will to do so - which there isn't.
Not having to pay the fine for 20 years means Google has 20 years before they have to change their behavior. Sure, they will know they have 19 more years worth of fines hanging over them if they end up losing the case, plus fines with from other countries who adopt similar laws.
Why should Google's management care about that now, when long before the impact is felt Google's management will have earned fat bonuses on GDPR violating behavior and retired to an island somewhere?
This post has been deleted by its author
Does anybody think the fine will actually be paid?
About 10+ years ago a bank in Boston MA incorrectly foreclosed on a house & evicted the occupants because of a clerical error. The homeowner sued the bank & got a judgement of about $50K which after six months of excuses the bank still had not paid.
So the homeowner got a lien on the bank branch. One sunny morning a group of moving vans showed up at the local bank branch & started inventorying the contents of the bank (including the cash) & putting it all in the vans. The bank manager hastily cut a cheque for $50K.
I suggest the same strategy.
For example what about the process required to use Google Search without an account? It display a page that requires mandatory consent to slurping with options to disable 'personalization' and more tracking dispersed in several sub-pages, different UIs, deceiving confirmations, and the need to click 'I agree' at the end, hoping settings were saved. And the process will plant a DoubleClick cookie in your browser.
I got used to search in private mode, so cookies are cleared, I wish browser would allow such option automatically, but as long the main one is made bu google itself, and the other needs Google money to survive, it will never happen.
"I wish browser would allow such option automatically, but as long the main one is made bu google itself"
It's only the "main one" because of the numbers of people who use it. Your post suggests you're one of those so it's partially your decision to make it that. You are free to do your bit to change it any time you want.
Hopefully the websites that tell you that all the cookies will be set unless you individually click to turn off each one will now sit up and take notice.
It is clear that explicit consent must be sought and services cannot be restricted unnecessarily if you withhold your consent. No the 'legitimate business' is not carte blanche to allow all processing.
Maybe, even, el Reg will take another look at their privacy policies?
As far as cookies are concerned, I am sick and tired of web sites that immediately assault me with a large popup talking about how they need cookies etc etc and the popup doesn't go away until I click Consent.
There is no Refuse option available.
As far as I'm concerned, that is forced consent, aka no consent at all. I hope GDPR will take note of that annoyance as well.
And when the site is not one that you can simply ignore? Sometimes, the site is one you are required to use. Either it is a site run by a business or governmental agency that you must use in order to fulfill some obligation, or in other cases it is the only site providing a necessary service. Other times, there are a number of alternatives, each of which has the same or similar cookie system. I have cookies autodeleted and do some other things to attempt to prevent this from being as creepy as it could be, but it isn't always possible to go elsewhere when these problems arise.
And when the site is not one that you can simply ignore?
Sounds like you take your training from....
If a site falls under these laws and breaches them, file a complaint. Or notify one of the 'watchdog' organisations so they can file a better complaint.
except that profiling users is not integral part necessary to even show ads, let alone show the contents of the website
and as it is not integral to providing the service, it requires informed and optional consent from the user according to GDPR
and this is exactly why google was fined
"...that little "X" in the corner of the browser window.""
Because that worked so well for Microsoft...
"Sometimes that is the best way to refuse the terms of service -- by not using the site/company and going elsewhere."
GDPR does not allow excessive data gathering to be tied to use of site. If a cookie is required for the operation of the site, e.g. to maintain state, that's OK. If it's to gather data about behaviour it requires separate explicit permission and service can't be withheld if permission isn't given. Breaching that aspect of GDPR brings fines.
If the cookies are required for website functionality rather than tracking, they're still required by the Cookie law to notify you about them but they're not required by GDPR to give you any choice in the matter. It is entirely possible that they're still doing bad things but it's not necessarily so.
Yeah, for something so horribly modern, that's getting real old. I hate following links to read articles and getting those stupid popups *everywhere*... they invite me to not use their site if I didn't like that, but since I had already *been* to the site, they had already dropped a cookie or sniffed others or whatever. And I wasn't going to come back or look around, and the ONE article I wanted was already rendered on my screen. So.
It is not just that. Enter your date of birth in your Google account and note that it says "Your birthday isn't shared". Now, for example, create an account with AirBnB and log in via your Google account. The first thing you see is AirBnB asking you to confirm that your date of birth (from Google) is correct.
The French tax authorities are finalizing a tax that will be applied this year.
Google's violations are so egregious and clear-cut, it's almost as if they were daring the DPAs. After years of impunity under their buddies in the Obama administration, they've developed a sense of impunity, and are going to be disabused. European Civil Law legal systems are not as vulnerable to abuse by capricious Common Law judges.
>Mammoth fine...
Not much of a mammoth though. The law allows a maximum fine proportional to the company's income (up to 4%) - but 50 million is not even 0.05% of Google's annual income. They can find this much in their other pants.
As to the zoological classification, if a fine of 4% is the mammoth (weighing say 5 tons), then 0.05% corresponds to about 60 kg - so this is at most a small sheep fine.
"Not much of a mammoth though. The law allows a maximum fine proportional to the company's income (up to 4%) - but 50 million is not even 0.05% of Google's annual income. They can find this much in their other pants."
On the other hand, they are doing this across the entire GDPR jurisdiction, currently 28 countries and only France, so far, has heard the case and fine them. It's entirely possible that there are 27 more similar fines in the future.
Thank you. I'd come to post that very point. 50M is *nothing* to a corporation making as much as Google. That might be, what, a few minutes profit on an ultra slow day? They could pay this out of petty cash & just wait until after (next meal) to buy the diamond encrusted cocaine snorting straws. You want them to notice? Change that M to a B or a T. THAT will hit them hard enough to *hurt*. If you don't make them grunt & wince at the pain they won't even notice your attempts to punish them. It's akin to a mosquito bite & won't change the actions of the "punished" at all.
TL;DR: Fuck a mere 50M. Make it 50T and watch them squirm.
I think you have your units confused. Mass is measured in Jubs (or in this case KiloJubs). Sheep are used to measure velocity: Approved Reg Standards.
"The law allows a maximum fine proportional to the company's income (up to 4%)"
It's a little more nuanced than that.
Firstly it's 2% or 4% depending on the offence. There's also what you might call the flat rate limit - 20m or 2% whichever is greater, 40m or 40% whichever is greater.
By setting the initial fine at 50m seems to indicate that they're going straight into "or greater" numbers for a start. And it is for a start; fines are rarely set at anywhere near maximum for a first offence (this is their first offence under GDPR). If there are other Google cases working their way through the system then it seems likely that with a first offence already recorded and a fine of this magnitude issued fines are going to get bigger unless Google shows a willingness to comply.
Any business considering how to react to GDPR should be looking at this as a warning that the fines are going to be orders of magnitude bigger than in the past.
TL;DR It's a shot across the bows.
>> "And eef you don't comply, vee shall taunt you a *second* time!"
Exactly. As long as the fines are tiny, Google will not be concerned, but the minute they get really large it will become political and Google will refuse to pay.
Just imagine what US politicians will be saying. "Those girly-man Euros are trying to fine our fine US corporations out from under us!" Then comes the escalation. "Ze Americans, zey are very bad, und require discipline!"
Then what? Shiza, meet fan.
I tend to think of this sort of fine as just a form of extortion. The general mindset is that "XXXX has lots of money, let's grab a chunk".
Personally, I'd like to see these businesses abandoning these countries, leaving them with minimal to no service. They'll probably figure something out, especially as their own security services rely on the same information for their spying (when they're not actively hacking our computers).
"Personally, I'd like to see these businesses abandoning these countries,"
GDPR applies to everyone in the EU, individuals, businesses, residents and visitors. It's not as if the likes of Google didn't have years to learn about and prepare for this. They chose to use their own interpretation of the law and wait for the courts to clarify it for them. They bet wrong and lost. Tough.
If Google have a fundamental problem with applying GDPR, then of course they have the right to pull all their services out of the EU and leave a market of 500 million people to their competitors.
> "If Google have a fundamental problem with applying GDPR, then of course they have the right to pull all their services out of the EU and leave a market of 500 million people to their competitors."
Let's say just hypothetically that GDPR isn't as fine a policy as is claimed. If that were the case, then fining Google until it left the EU market could be seen as a form of protectionism. Yes I understand that GDPR is very good indeed, but I bet there have been some criticisms of it, correct? Or is this a case of the science being 'settled,' with no further discussion allowed?
I say these things as a non-expert. I make no claims of deep understanding about GDPR; I merely look at the politics of the situation. People here are pointing out that Google has had plenty of warning about the policy, as if that itself was justification for the policy. Again, it could easily be justified. I just object to the way people here are assuming the policy is so good that there's no need to even discuss it.
Is there a clear, easy to read justification for GDPR I can view, one that doesn't make a bunch of unstated political assumptions? As a Yank I'd be very interested in that.
"Let's say just hypothetically that GDPR isn't as fine a policy as is claimed. If that were the case, then fining Google until it left the EU market could be seen as a form of protectionism. Yes I understand that GDPR is very good indeed, but I bet there have been some criticisms of it, correct? Or is this a case of the science being 'settled,' with no further discussion allowed?"
There has been and continues to be, lots of discussion over GDPR. Google and their ilk spent millions lobbying their side during the development of GDPR. They were well aware of how it would work, the principles of implementation and when it would be implemented. They used EU based staff, lobbyists and lawyers who were well versed in the arguments so that they could put Googles side over. Google simply cannot claim that they didn't know or understand the issue or the implications of their subsequent acts.
Having said all that, Google don't seem to have an issue with building a special version of their search engine to fit in with the far more stringent rules in China. Possibly because it's also a big market, but also because they have real competition there.
Personally, I'd like to see these businesses abandoning these countries
Me to. I'd very much like to see them leave my country as well!
I'll even provide the plane. Ok it's not passed it's airworthyness tests but you'll be OK so long as you don't hit any turbulence. Unfortunately I could only find a cheap pilot who really is OK even though he seems too doped up to know where he is, and the bearings on the hydraulic pumps look just about shot, but I'm sure you'll be OK.
Apple have gotten away with so much for years, it seems very strange. Microsoft in the late 90s was almost broken up due to the United States v. Microsoft Corp. Yet Apple have pretty much been allowed to do similar for years. Having said that Steve Jobs was stopped in court from making Jailbreaking illegal and America appears to slowly be seeing the light and bringing in Right to Repair. But despite that, Apple are still getting away with shady shit regarding repairs and not allowing unauthorised repair shops from repairing their kit, surely that is anti-competitive.
https://www.youtube.com/watch?v=o2_SZ4tfLns&t=5s
https://www.youtube.com/watch?v=K669-vhKshU
Just a couple of examples.
"Be a paying user, or a shaven sheep? I'll take the former, thanks."
Could we be sure about the either/or option possibilities there, though?
Big Zucker's millionaire lawyers, who've provided such [/outstanding/] advice so far, may already be working on proposals to now make us pay while we quietly continue to be shorn of our data.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
