Court case N° 430810 – Court Ruling (France, 2020)

CNIL issued a fine of € 50 million against Google in CNIL - SAN-2019-001 after two complaints filed by noyb and La Quadrature du Net on the basis of lack of transparency of the privacy policy and the lack of valid legal basis to process the data. Google appealed the decision of the CNIL on several grounds, including the lack of competence of the CNIL since Google would have its main establishment in Ireland. The Conseil d'Etat confirmed the decision of the CNIL in all points and considered that the CNIL was competent to deal with the case since Google did not have a main establishment in the EU at the time of the decision of the CNIL. The Conseil d'Etat also confirmed that Google's privacy policy was not sufficiently transparent since the information was disseminated throughout several documents and was not easily accessible. The Conseil d'Etat also confirmed that the consent obtained by Google was not valid since it was not sufficiently informed and specific (the users had to accept all processing operations without the possibility to refuse specific processing operations in the first layer of information). Finally, the Conseil d'Etat confirmed that the fine was not disproportionate considering inter alia the seriousness of the violation, the financial capacity of Google, the impact of people and the duration of the violation.