Google LLC – €50,000,000 Fine (France, 2019)

The NGO noyb filed a complaint with the CNIL related to the following practice: Google is conditioning the use of a phone running Android to the acceptance of Google’s terms and conditions and privacy policy, making the device unusable otherwise. The NGO la Quadrature du Net (LQDN) filed a complaint with the CNIL about Google's lack of lawful basis to process personal data for targeted advertising purposes. The CNIL decided to gather the two complaints and decide on them in a single decision, following an extensive investigation. Google's main arguments were that the complaints are inadmissible and there was a violation of the company's right to a fair trial (art. 6 ECHR), in particular because of the language used (French) and the imparted time to respond. Does the Google's acceptance system for terms and conditions and privacy policy are in line with the transparency and information obligations? Is there a legal basis for the processing? Is the case admissible? Is the company's right to a fair trial violated? On the admissibility, the CNIL replied that the admissibility of the complaints would in any case have no influence on the legality of the procedure because the CNIL’s competency is not subject to the receipt of a complaint, the DPA can initiate proceedings ex officio on the basis of its own findings. On the alleged violation of the defendant's rights to a fair trial, the CNIL rejected both arguments. On the failure to comply with transparency and information obligations: In essence, the CNIL acknowledged that Google has made progress in terms of transparency and control given to users over their personal data. It then comes to the notion information accessibility, according to which the data subject must be able to determine in advance which processing operations will be performed. The CNIL notes that Google has scattered the information in several documents, not all of which are directly accessible, and that Google's design choices fragment the i