Lessons From Google's €50m GDPR Fine: Part I

On 21 January 2019, the French data protection authority (the "CNIL") fined Google LLC ("Google") €50 million under GDPR. The CNIL issued the fine having found that Google breached certain transparency and lawful processing obligations. This is the largest fine that has been issued since GDPR came into force. Google has indicated its intention to lodge an appeal.

We analyse the CNIL's decision, taking a look at how the CNIL found that it had jurisdiction and explaining the potential flaws in the CNIL's conclusions.

In a follow-up post, we will consider the CNIL's decision regarding transparency and consent.

Background

This decision stemmed from complaints issued in May 2018 by privacy activist groups, None of Your Business ("NOYB") and La Quadrature du Net Association ("LQDN"). Specifically, NOYB alleged that users of Android phones were unable to use their devices without first accepting Google's Privacy Policy and Terms of Service. LQDN complained that