Google Hit With €50 Million Fine Over GDPR Violation

On the 25^th May 2018, the same day on which the General Data Protection Regulation ("GDPR") came into effect, complaints were filed against Google by two groups which advocate for privacy rights. The complaints were filed in France with the French data protection authority, the National Commission on Informatics and Liberty ("CNIL"). The complaints alleged that Google did not have a valid legal basis to process user data for the purpose of ad personalization.

The GDPR sets up a one-stop-shop mechanism which provides for the coordination of data protection authorities within the EU. In this case, Google's European headquarters are situated in Ireland and the CNIL had to assess whether it was competent to deal with the complaints. It was established that Irish data protection authority did not have "decision-making powers" over Google's Android operating system and Google's services and thus CNIL was competent to take any decision regarding processing