The first significant fine in the GDPR-era was imposed by the French data protection authority (CNIL) on Google LLC, for the Internet’s giant’s alleged violations of the GDPR’s rules on user transparency and consent in Google’s Android operating system for smartphones.
The CNIL alleges that Google’s Android system does not provide sufficiently transparent notices to users about the processing activities that Google conducts, in regard to the purposes of processing, retention periods and the types of data used for targeted advertising purposes. CNIL found that information on these issues is provided in vague terms and is scattered across a number of locations and documents.

The CNIL also alleges that Google does not properly explain to its users the implications of consenting to processing personal data for targeted advertising purposes and that user accounts are set to consent to such processing by default, rather than by having users explicitly opting-in as the GDPR requires.
The CNIL justified the massive fine due to the scope of Google’s non-compliance in terms of the invasive form of processing for behavioral advertising purposes and the number of data subjects potentially impacted. It also noted Google’s “prominent place in the market for operating systems and the seriousness of the deficiencies” that the CNIL found in terms of the violation of the “fundamental guarantees enabling people to maintain control of their data”.

The decision also addresses CNIL’s jurisdiction over Google LCC, a Delaware company headquartered in Mountain View, California. The CNIL found that Google’s subsidiary in Ireland, which is under the jurisdiction of the Irish data protection authority, does not have sufficient decision-making power as to the data processing activities on Android. Therefore, Google Ireland cannot be considered the principal place of business for EU data protection matters on Android, which in turn enables the CNIL to exercise its jurisdiction over Google LLC on the basis of Google’s subsidiary in France.

Google is likely to file an appeal against the CNIL’s decision and the fine.

CLICK HERE to read the French regulator’s decisions (in French).