Paris (CNSNews.com) – With Google having received the biggest fine yet under new European Union data protection regulations, similar privacy complaints are pending against other Internet giants, including Facebook, YouTube and Apple.
Austria-based non-profit None Of Your Business (NOYB) and Paris-based Internet rights group La Quadrature du Net (LQDN) were among those to have lodged a complaint against Google last May, after the E.U. adopted the new privacy rules.
The two organizations have other complaints in the works – NOYB against Facebook and its subsidiaries WhatsApp and Instagram, and LQDN against Apple, Facebook, Amazon and Microsoft.
The action against Google came from the Paris-based National Data Protection Commission (CNIL), which said the Mountain View, Calif. company was breaking the regulations by failing to get users’ consent for data processing and personalized ads on Google Search, Google Maps and its YouTube platform. CNIL said Google was also not explaining its data collection policies adequately.
The rules in question are the General Data Protection Regulation (GDPR) adopted last May, designed to give E.U. citizens control of their personal data, while simplifying the regulatory environment for businesses. It is applicable in all 28 E.U. member-states
NOYB data protection lawyer Ioannis Kouvakas told CNSNews.com the organization welcomed the “CNIL decision to uphold users' rights and to impose harsh fines to a company that did not wish to comply with the strict GDPR requirements on consent.”
He added that it was the first decision to come after NOYB filed four complaints last spring, the others against Facebook and its WhatsApp and Instagram services.
“The decision made by the CNIL highlights the crucial need for transparency in the processing of personal data by companies, especially when the latter have a dominant position in the tech-market,” Kouvakas said.
LQDN said in response to the decision that as CNIL considers its other complaints it should look to impose sanctions that are proportional to the companies’ income, and “taking into account the extent and duration of the violation of our rights.”
Responding to queries, a Google spokesperson said in an email, “People expect high standards of transparency and control from us. We’re deeply committed to meeting those expectations and the consent requirements of the GDPR. We’re studying the decision to determine our next steps.”
If it chooses to do so, Google could appeal the decision to France’s highest court, the Conseil d'Etat, which serves as “the final arbiter of cases relating to executive power, local authorities, independent public authorities, public administration agencies or any other agency invested with public authority.”
Dan Shefet, a French lawyer specializing in international law, intellectual property, IT and competition laws welcomed the CNIL decision, saying in a phone interview it was “the first step that showed that the French organization is legally competent in this case.”
Shefet said he is working on a complaint relating to “cookies” used by many companies in their websites, to gauge how the CNIL will view the issue.
In the case of cookies, he said, companies need the consent of users and should inform them how long they will be used for.
In its latest issue, the IT magazine ZDNet predicted that many web professionals will be looking into how their practices will need to change, to comply with the GDPR.