In January, the National Data Protection Commission (CNIL), a French authority responsible for the application and supervision of data protection in the country, issued a fine of 50 million Euros, grounded on an alleged failure in transparency by Google to its users of the treatment given to personal data and in the lack of valid consent for the customization of advertising on its digital platforms.
Although it may not be the first penalty issued under the aegis of the GDPR (General Data Protection Regulation), it is, up to now, the highest amount, which is cause for even greater concern to the companies who practice data processing, including in Brazil. This, of course, considering that Brazilian law almost fully replicates the rules provided by the GDPR.
One of the legal questions raised in the Google case was that of the jurisdiction of the French authority to prosecute and judge the alleged violations of the North American company, with its headquarters in Ireland. The question was raised by the fined company in its defense, however, the commission decided to go ahead with the prosecution. The argument? Not having an establishment of the company in France and considering that the associations filing the complaint are based in that country, the body would not have jurisdiction.
Furthermore, from the very content of the decision, it is possible to conclude that the French authority has considered a “lack of transparency” to the users in the processing of their data. One example was the users’ difficulty to gain access or the lack of information relating to the data processed by Google and the lack of specific consent of the users.
The severity of the penalty applied to Google was also the subject of discussion. This is because it reflects the seriousness with which the data protection authorities have conducted their activities in the application of the protective legislation for individuals in the handling of personal data. The measures adopted have led various companies to prepare themselves operationally for a full adaptation to the rules and supervision of these entities.