French Data Protection Authority Fines Google For Breach Of General Data Protection Regulation

On 21 January 2019, the French Data Protection Authority (Commission Nationale Informatique et Liberté – "CNIL") imposed a fine of € 50 million on Google for infringing the General Data Protection Regulation 2016/679 (the "GDPR"). As the operator of the Android system, Google was found to have breached various requirements of the GDPR, including providing insufficient information to users and failing to obtain valid consent for the personal advertisements targeting users. CNIL asserted its territorial jurisdiction over Google, arguing that Google could not benefit from the one-stop-shop principle under the GDPR. Given its possible value as a precedent for the enforcement of data protection rules across Europe, the CNIL decision also has its place in a newsletter covering Belgian legal developments.