On January 21, 2019, the French Data Protection
Authority (the "French DPA") fined Google LLC 50 million
euros for violating the requirements of the GDPR "for lack of transparency,
inadequate information and lack of valid consent regarding the ads
personalization." This is the first major enforcement by
a European DPA since the GDPR came into force in May 2018.
How can your company avoid being the next target of an EU DPA?
Below are useful checklists of accepted and unaccepted practices
for privacy policies and methods for securing consent, consistent
with the French DPA's decision.
The French DPA relied quite heavily upon the guidelines issued
by the European Data Protection Board (the successor
of the WP29) about transparency and consent. This decision is therefore of
interest to all companies that collect personal data in relation to
products or services offered to individuals in the EU, even though
they may not offer them in France.
