French data protection authority CNIL prepares to fine Google

The recent row between Google and the French national data protection authority(CNIL) is a foretaste of how European data protection authorities might work together in the future under the proposed draft Data Protection Regulation currently being debated in Brussels. The draft Regulation includes proposals for greater cooperation between EU national data protection authorities. As it stands, Google could face a fine of up to €300,000 under French law but could also face similar enforcement actions in several other member states.

CNIL is launching formal sanctions against Google for its alleged failure to heed an order to modify its March 2012 privacy policy to comply with French national data protection law. Google had three months in which to respond to the enforcement notice and replied on the last day of this period contesting the reasoning of the CNIL and the applicability of French data protection law to Google’s services used by French residents. To date, Google has not implemented the changes CNIL requested.

CNIL vs Google: a recap
In case you haven't been following the story, it began when Google introduced its March 2012 privacy policy. In June 2013, CNIL issued Google with an enforcement notice to comply with French data protection law within three months. This followed an analysis by the EU national data protection authorities of the Member States of the EU of the March 2012 privacy policy, who appointed the CNIL as the lead regulator on this issue.

The enforcement notice required Google to make the following changes to the March 2012 privacy policy:

1. Define specified and explicit purposes.

2. Inform users of Google’s services with regard to the purposes of the processing implemented.

3. Define retention periods for the personal data processed by Google.

4. Not to proceed without a legal basis with the potentially unlimited combination of users data from the different Google services they had had signed up for separately.

5. Fairly collect and process data from those visitors to Google-owned websites who had not signed in/registered.

6. Inform users and then obtain their consent before storing cookies on their devices they were using to access Google’s services.

James Milligan, Solicitor, DMA