Google to appeal GDPR fine set by French regulators

The decision by France’s National Data Protection Commission or CNIL to impose fine on Google under Europe’s newly minted General Data Protection Regulation or GDPR is making headlines for a number of significant reasons.

One, France’s move is a strong signal that Europe is adamant to enforce GDPR policies — an area where the United States lacks teeth even with numerous privacy allegations thrown at other big tech companies such as Facebook and Apple.

Estelle Masse, a data protection expert at the advocacy group Access Now, said more U.S. tech companies could soon find themselves in a similar situation under the EU’s GDPR since breaches are seemingly common among them.

Second, observers think that the nearly $57 million fine imposed on Google falls flat given that Google’s parent, Alphabet Inc., has been amassing an estimated quarterly revenue of $11 billion in Europe, the Middle East, and Africa.

“[The fine] is very low in comparison to Google’s annual turnover,” La Quadrature du Net, one of the consumer groups which filed complaints against Google, said. While it is satisfied that the French regulators acted to penalize Google, the group said the authorities only investigated a small portion of its complaint.

Had French regulators looked into the whole scope of its complaint, the group said Google could be fined to as much as $4.7 billion — which would still pale in comparison to what Google is earning from its ads.

France’s fine a mere pinch on Google’s ad revenue

At the center of the controversy is an investigation conducted by CNIL from June to September 2018 based on complaints lodged by privacy rights advocates None Of Your Business and La Quadrature du Net in May.

France’s National Data Protection Commission is set to impose a fine on Google under Europe’s GDPR ruling. (Source)

The CNIL conducted inspections of Google’s European headquarters in Ireland. Investigations revealed that Google had deliberately made it taxing for users to manage their personal information which the company used for their targeted ads. The process users have to undergo to manage their preferences on how their data are used for Google advertising is deliberately fragmented and vague. With this, users, when setting up their new Google accounts, are intentionally herded toward giving their consent even if they do not understand what they have actually consented to —  a practice which Europe’s GDPR policy is particularly intended to abolish.

As mentioned, the French regulators decided to impose nearly $57 million fine on Google for this violation, which if really looked into, is rooted in the company’s aim to boost its advertising platform.  

In that case, observers were only right to be adamant about how little the fine was. For context, in 2017, Google’s ad revenue reached nearly $95.4 billion from $79.38 billion in 2016. The company earned a total of $110.9 billion in total revenues in 2017 alone. Of that amount, 70.9 percent came from ad revenues through Google sites.

Google to appeal France’s fine

On Tuesday, Google said it will appeal against the fine, arguing that it designed its consent policies within the bounds of Europe’s GDPR.

“We’ve worked hard to create a GDPR consent process for personalized ads that are as transparent and straightforward as possible, based on regulatory guidance and user experience testing,” Google said in a statement.

The tech company added, “We’re also concerned about the impact of this ruling on publishers, original content creators and tech companies in Europe and beyond. For all these reasons, we’ve now decided to appeal.