France: Conseil d'Etat rejects Google's appeal against CNIL's €50M fine
The Conseil d'Etat ('the Council') issued, on 19 June 2020, a decision in which it rejected the appeal of Google LLC against the French data protection authority's ('CNIL') €50 million fine under the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), finding that such fine was not disproportionate. In particular, the Council found that Google had not sufficiently informed Android users in a clear and transparent manner of the processing of their personal data. Specifically, the Council agreed with CNIL that Google did not comply with the obligation of information to the data subject or respect the principle of transparency, meaning that data subjects could not offer freely-given, specific, informed, and unambiguous consent to the processing of their personal data for direct marketing purposes.
Furthermore, the Council noted, among other things, that data subjects lacked information regarding the data retention period and the different purposes of processing, and that the marketing system is particularly intrusive. In relation to the fine itself, the Council considered factors such as the gravity of the violations, their repetition and duration, the GDPR's thresholds for fines, and Google's financial situation in deciding that the fine was not disproportionate. Moreover, the Council clarified that the 'one-stop-shop' system of the GDPR was not applicable to this case and, as such, CNIL was the competent authority to issue the fine, not the Irish Data Protection Commissioner ('DPC') as maintained by Google.
In addition, CNIL responded, on 19 June 2020, with a statement ('the CNIL Statement') summarising the Council's reasoning and adding that the fine constituted the most important issued by data protection authorities in Europe.
UPDATE (29 June 2020)
CNIL publishes English translation of its statement
CNIL published, on 29 June 2020, an English translation of its statement on Conseil d’Etat’s decision to confirm the sanction imposed on Google.
You can read the English translation of the CNIL Statement here.