As we reported
on this blog, just after GDPR became applicable, noyb.eu (None of Your Business), the
non-profit privacy organization set up by Max Schrems, the Austrian
lawyer who initiated the action against Facebook that
led to the invalidation of the Safe Harbor, and a French
organization called "La Quadrature du Net", filed the first
complaints based on GDPR. These complaints targeted major
technology companies such as Google, Facebook, Instagram, Whatsapp
and Linkedin before various European DPAs. The French DPA is the
first one to render a decision against one of these tech
giants.
In its decision, the DPA explains that it
investigated the Android's user "click path" from the
creation of a Google account to the day-to-day use of the
smartphone and found that Google was in breach of two of the GDPR
main principles:
