On January 21, 2019, a select panel of the French data
protection authority, CNIL, which has the power to impose
sanctions, fined a major technological services provider €50
million following its failure to comply with the obligations
provided for in the General Data Protection Regulation (GDPR). The
provider did not adhere to transparency and information
obligations, and it did not set up a legal database for processing
personal data collected for advertising purposes.
Following the implementation of the GDPR on May 25, 2018, the
CNIL received collective complaints concerning this particular
Internet giant from Austrian nonprofit None of Your Business and
French NGO La Quadrature du Net. They claimed that it did
not have a valid legal database for processing the personal data of
service users, in particular for the purpose of the personalization
of advertisements.
