Google has been fined nearly $57 million by French regulators for violating Europe's new data-privacy rules -- the first major penalty brought against a U.S. technology giant since the regionwide regulations took effect last year.
France's top data-privacy agency -- the National Commission on Informatics and Liberty -- said Monday that Google failed to fully disclose to users how their personal information is collected and what happens to it. Google also did not properly obtain users' consent for the purpose of showing them personalized ads, the agency said.
To French regulators, Google's business practices ran afoul of Europe's new General Data Protection Regulation. Implemented in 2018, the sweeping privacy rules have forced Google and its tech peers in Silicon Valley to rethink their data-collection practices or risk sky-high fines.
The United States lacks a similar, overarching federal consumer privacy law, which privacy-rights advocates say has turned Europe into the region setting the global standard for online privacy.
Despite Google's recent changes to comply with the European Union rules, the French agency said in a statement that "the infringements observed deprive the users of essential guarantees regarding processing operations that can reveal important parts of their private life since they are based on a huge amount of data, a wide variety of services and almost unlimited possible combinations."
In response, Google said it is "studying the decision to determine our next steps," adding: "People expect high standards of transparency and control from us. We're deeply committed to meeting those expectations and the consent requirements of the [General Data Protection Regulation]."
French regulators began investigating Google on May 25 -- the day the regulation went into effect -- in response to concerns raised by two groups of privacy activists. They filed additional privacy complaints against Facebook and its subsidiaries, photo-sharing app Instagram and messenger service WhatsApp, in other EU countries.
"We are very pleased that for the first time a European data protection authority is using the possibilities of [the regulation] to punish clear violations of the law," said Max Schrems, the leader of the nonprofit NOYB -- an acronym for "None Of Your Business."
"It is important that the authorities make it clear that simply claiming to be complaint is not enough," Schrems added.
Europe has already demonstrated its willingness to punish U.S.-based tech companies for their missteps. In recent years, EU officials have penalized Apple for its tax practices, investigated Facebook for multiple privacy scandals and slapped Google with a record-breaking fine on charges it sought to undermine its corporate rivals.
U.S. consumer advocates on Monday strongly encouraged Washington to follow Europe's lead.
"The big question now is why the Federal Trade Commission failed to act against the tech firms over these many years," said Marc Rotenberg, the executive director of the Electronic Privacy Information Center. The Federal Trade Commission is Washington's top privacy and security agency.
Under the EU's data privacy law, tech giants including Google must give users a full, clear picture of the data they collect, along with simple, specific tools for users to consent to having their personal information harnessed. In both cases, France said that Google had erred.
Full details about what Google does with users' personal information are "excessively disseminated across several documents," according to the National Commission on Informatics and Liberty. The French agency said the lack of transparency is especially concerning because of the sheer volume of services Google operates -- including its maps service, YouTube and its app store.
Even though Google users can modify their privacy settings when they create an account, French regulators said it still isn't enough, partly because the default setting is for Google to display personalized ads to users. Meanwhile, Google requires people who sign up to agree to its terms and conditions in full to create their accounts. The agency criticized that form of consent, saying that it requires users to agree to everything -- or not use the service at all.
Some consumer advocates still bristled that France had not gone far enough. La Quadrature du Net, one of the groups that filed the complaint against Google, lamented that the fine is "very low in comparison to Google's annual turnover."
The group, which has a name that translates as "Squaring of the Net," said its members appreciated the initial move to fine Google, but they felt that the French regulators had focused only on a small portion of their complaints about the tech company. They said they hoped that the enforcement agency would respond soon to the rest of their complaint, and they noted that the maximum possible fine for the violations they allege is more than $4.7 billion.
Information for this article was contributed by Quentin Aries of The Washington Post.
A Section on 01/22/2019