France’s highest court upholds Google’s €50 million GDPR fine

The Council of State (the highest court in France) has upheld a €50 million GDPR fine issued to Google.

CNIL imposed €50 million fine

The CNIL (France’s data supervisory authority) fined Google €50 million in January 2019 (discussed in our previous article). The CNIL found users had not given adequate consent to Google’s advert personalisation model. Google were also found to not have a legal basis for processing users’ data for this purpose. 

Google appealed the fine. 

Council of State rejects Google’s appeal

The Council of State has upheld the original fine. It held the fine was appropriate based on various factors, including:

• The gravity of the breaches
• The breaches’ continuous nature and duration
• The maximum available fines under the GDPR and 
• Google’s financial situation.

The Council of State also confirmed CNIL could issue the penalty despite Google being headquartered in Ireland. It ruled that “the Irish subsidiary of Google had no power of control over the other European subsidiaries, nor any decision-making power over the data processing” at the date of the sanction.

Implications

This fine was a wake-up call to organisations when originally issued. Now upheld by the Council of State, the risks are re-emphasised. 

To date, this remains the highest GDPR fine issued.

Google failed to establish a lawful basis for processing the data. When relying on consents, organisations must ensure the higher hurdles under the GDPR are met. Otherwise they will need to  clearly establish another lawful basis for processing data. This should be recorded in writing. 

The ICO is finalising its decisions on notices of intent to fine originally issued to British Airways (of £183.39 million) and Marriott (of £99.2 million). These decisions were due earlier this year but have been pushed back. 

The ICO’s decisions are eagerly awaited, but the Council of State’s ruling shows that across Europe, the increased fines under the GDPR can have a significant impact.