European Data Protection Agencies Sanction Google for Violations of European Data Protection Law

In December 2013 and January 2014, respectively the Data Protection Authorities of Spain and France sanctioned Google for privacy violation, imposing fines of EUR 300,000 and EUR 150,000.

The background: In 2012 Google announced its decision to replace the individual privacy policies of each of its products and services with a single privacy policy. A European independent advisory body – Article 29 Working Party (see Art 29 WP for its composition)

immediately expressed privacy concerns and launched an investigation. Article 29 Working Party rendered its findings in October 2012: Google’s privacy policy did not comply with the European Directive on Data Protection as: 1) it did not inform the users of the type of data collected and the exact purpose for which these data are collected; 2) it used without authorization for different purposes data collected from Google’s various online services and finally, 3) it did not specify the data retention periods. Article 29 Working Party issued recommendations to ensure compliance with the European data protection laws and principles but it seems that Google refused to implement them.

As a consequence, in April 2013, six European Data Protection Authorities (Germany, France, Italy, Spain, the Netherlands, and the UK) launched legal actions against Google for violation of privacy law.

So far, Spain and France are the only two Data Protection Authorities that have issued fines against Google.

As said, in January 2014 the French Data Protection Authority (CNIL) fined Google EUR 150,000 after finding that its privacy policy does not comply with French Data Protection laws. Google appealed the decision. In December 2013, AEPD, the Spanish Data Protection Authority, imposed on Google a fine of EUR 300,000 Euro as it found that the corporation unlawfully collected and processed personal information.

In November 2013 the Dutch Data Protection Authority found that Google violated the Dutch privacy law, but has not yet issued sanctions.

More decisions are to be expected on the issue as investigations are still on-going in Germany, the UK, and Italy.

Training