Google Hit With €50m Fine Following Crowd-Sourced GDPR Complaint

The French data protection regulator, CNIL, hit Google with a €50m fine this week following a crowdsourced complaint. Perhaps the most interesting aspect of this fine is the public trigger to the investigation and the eagerness of the authority to then run with the complaint.

THE PUBLIC TRIGGER

The Google investigation was triggered by submissions from two data privacy NGOs - None of Your Business (NOYB) and La Quadrature du Net (LQDN). The complaints claimed that Google’s data-sharing consent management system was in breach of the GDPR and asked that action be taken. NOYB and LQDN are crowd-funded groups and enjoy wide support, with LQDN’s complaint here backed by 9974 signatures.

CNIL received the complaints in the same week that the GDPR came into force and promptly began the investigation the following week. Although CNIL argued in its decision notice that the NOYB and LQDN complaints were fundamentally immaterial to the investigation (in a procedural sense) as CNIL was competent to examine the issues independently, the essential truth is that this matter was never the regulator’s “baby”.

MOVE FAST, INVESTIGATE THINGS

What followed was a speedily efficient investigation that largely found merit in the arguments of NOYB and LQDN. Along the way the regulator received numerous submissions from Google that it was being treated unfairly around deadlines, translations, representations and so on and, reading the decision notice, there is the general impression of a regulator in a hurry.

LESSONS FOR BUSINESS

What we see here then is an enforcement environment where the regulator was more than happy to take its lead from consumer rights bodies, an approach which is entirely congruent with fundamental elements of the GDPR. This is also in line with the recent ICO criminal prosecution of Cambridge Analytica in the UK for a serious breach concerning a subject access request, which also began with a consumer complaint.

For business, the take-home message is that their customers are becoming ever more aware of their data privacy rights and ever more able to enforce them, in part thanks to sympathetic regulators.

In this environment the lesson must be - don’t give your customers or the wider public any cause for complaint. Make sure that your data privacy compliance is in order (see our solutions for GDPR compliance and CPRA compliance) and that you are able to respond to any requests promptly. If you fail to do so and manage to frustrate the people you deal with, don’t be surprised if the regulator comes knocking.