CNIL (France) - SAN-2021-004: Difference between revisions

From GDPRhub
 
(4 intermediate revisions by 2 users not shown)
Line 56: Line 56:
}}
}}


Following their decision to fine Google €100,000,000 for not complying with the cookies regulation, the CNIL accepted Google's adjustments and decided to close the case.
Following their decision to fine Google €100,000,000 for not complying with the cookies regulation, the CNIL accepted Google's adjustments and decided to close the case. However, the DPA stated that this only refers to the precautionary measures taken in their original decision, and reserved the right to further analyze Google compliance with the cookies regulation and the latest CNIL guidelines on the matter.


== English Summary ==
== English Summary ==
Line 69: Line 69:
The CNIL accepted Google's reply on their adjustments, considering that the cookie banner and the cookies mechanisms used by google.fr were now sufficiently clear and provided adequate information about the cookies they use, including the purposes of the processing and information about how to reject them.  
The CNIL accepted Google's reply on their adjustments, considering that the cookie banner and the cookies mechanisms used by google.fr were now sufficiently clear and provided adequate information about the cookies they use, including the purposes of the processing and information about how to reject them.  


Therefore, the CNIL decide to close this case. However, the authority stated that this [https://www.cnil.fr/fr/cloture-injonction-prononcee-encontre-google only refers to the precautionary measures took in their original decision], and that they reserve the right to further analyze Google compliance with the cookies regulation and their [https://www.cnil.fr/sites/default/files/atoms/files/recommandation-cookies-et-autres-traceurs.pdf recommendation issued on 17 September 2020], and to start a new sanctioning proceeding if necessary.  
Therefore, the CNIL decided to close the case. However, the authority stated that this [https://www.cnil.fr/fr/cloture-injonction-prononcee-encontre-google only refers to the precautionary measures took in their original decision], and that they reserve the right to further analysis of Google's compliance with the cookies regulation and their [https://www.cnil.fr/sites/default/files/atoms/files/recommandation-cookies-et-autres-traceurs.pdf recommendation issued on 17 September 2020], and to initiate a new sanctioning proceeding if necessary.  


== Comment ==
== Comment ==
Line 81: Line 81:


<pre>
<pre>
HomeAbout the lawAuthoritiesIndependent administrative authoritiesDeliberation SAN-2021-004 of April 30, 2021Deliberation SAN-2021-004 of April 30, 2021Carry out a search in: All contentSelect a fund
Deliberation of restricted committee n ° SAN-2021-004 of April 30, 2021 relating to the injunction pronounced against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED by deliberation n ° 2020-012 of December 7, 2020
Codes


Consolidated texts
The National Commission for Informatics and Freedoms, meeting in its restricted formation composed of Messrs Alexandre LINDEN, President, and Philippe-Pierre CABOURDIN, Vice-President, and Ladies Anne DEBET and Christine MAUGÜE, members;


Official newspaper
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of personal data and the free movement of such data;


Circulars and Instructions
Considering the law n ° 78-17 of January 6, 1978 modified relating to data processing, files and freedoms, in particular its articles 20 and following;


Constitutional case law
Having regard to decree no 2019-536 of 29 May 2019 taken for the application of the law
No. 78-17 of 6 January 1978 as amended relating to data processing, files and freedoms;


Administrative case law
Having regard to deliberation no 2013-175 of 4 July 2013 adopting the internal regulations of the National Commission for Informatics and Freedoms;


Judicial case law
Having regard to deliberation no 2020-012 of December 7, 2020 pronouncing a sanction against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED;


Financial case law
Considering the elements transmitted by the company GOOGLE IRELAND LIMITED on December 18, 2020 and March 30, 2021;


Branch agreements and collective agreements
Having regard to the other documents in the file;


Company agreements
After deliberation, adopted the following decision:


CNIL
I. Facts and procedure


All contents
Deliberation No. 2020-012 of December 7, 2020 ordered the companies GOOGLE LLC and GOOGLE IRELAND LIMITED to:


    / * <! [CDATA [* /
bring the processing into line with the obligations resulting from Article 82 of the Data Protection Act and, in particular, to inform the persons concerned in advance and in a clear and complete manner, for example on the information banner on the home page of the google.fr site:


    var searchConfigs = [];
- the purposes of all cookies subject to consent,
   


- the means at their disposal to refuse them.


var config = {base: "CODE", value: "code", url: "\ / search \ / code", sort: ["RELEVANCE"], defaultTarget: "ALL", targets: "ALL, TITLE, ARTICLE, TABLE, NUM_ARTICLE "};
This injunction was accompanied by a fine of 100,000 euros per day of delay at the end of a period of three months following the notification of the deliberation, the supporting documents of the compliance having to be sent to the restricted formation in this case. time limit.
searchConfigs.push (config);


var config = {base: "LODA", value: "lawarticledecree", url: "\ / search \ / lois", sort: ["RELEVANCE", "SIGNATURE_DATE_DESC", "SIGNATURE_DATE_ASC", "PUBLICATION_DATE_DESC", "PUBLICATION_DATE_ASC"] , defaultTarget: "ALL", targets: "ALL, TITLE, NUM_ARTICLE, ARTICLE, VISA_NOTICE, NUM, NOR, SIGNATURE"};
On December 18, 2020, the company GOOGLE IRELAND LIMITED sent a letter to the CNIL in which it presented the changes it planned to deploy on the google.fr website by the end of February 2021 and to which the services of the CNIL responded on February 17, 2021.
searchConfigs.push (config);


var config = {base: "JORF", value: "jorf", url: "\ / search \ / jorf", sort: ["RELEVANCE", "SIGNATURE_DATE_DESC", "SIGNATURE_DATE_ASC", "PUBLICATION_DATE_DESC", "PUBLICATION_DATE_ASC"] , defaultTarget: "ALL", targets: "ALL, TITLE, NOR, NUM, NUM_ARTICLE, ARTICLE, VISA_NOTICE, SIGNATURE"};
On March 30, 2021, within the time limit set by the deliberation, the company GOOGLE IRELAND LIMITED sent the restricted formation elements in order to justify its compliance.
searchConfigs.push (config);


var config = {base: "CIRC", value: "circ", url: "\ / search \ / circ", sort: ["RELEVANCE", "SIGNATURE_DATE_DESC", "SIGNATURE_DATE_ASC", "PUBLICATION_DATE_DESC", "PUBLICATION_DATE_ASC"] , defaultTarget: "ALL", targets: "ALL, TITLE, NOR"};
II.Reasons for the decision
searchConfigs.push (config);


var config = {base: "ACCO", value: "acco", url: "\ / search \ / acco", sort: ["RELEVANCE", "SIGNATURE_DATE_DESC", "SIGNATURE_DATE_ASC"], defaultTarget: "ALL", targets : "ALL, RAISON_SOCIALE, IDCC, TITLE"};
The restricted committee notes that it emerges from the elements provided in the response letter of March 30, 2021 that people visiting the google.fr site are now clearly and completely informed of all the purposes of cookies subject to consent. and the means available to them to refuse them, through the information banner displayed on their arrival on the site.
searchConfigs.push (config);


var config = {base: "CONSTIT", value: "constit", url: "\ / search \ / constit", sort: ["RELEVANCE", "DATE_DESC", "DATE_ASC"], defaultTarget: "ALL", targets : "ALL, TITLE, NUM_DEC, TEXTE"};
Consequently, the restricted committee considers that the companies GOOGLE LLC and GOOGLE IRELAND LIMITED have satisfied the injunction within the allotted time.
searchConfigs.push (config);


var config = {base: "CETAT", value: "cetat", url: "\ / search \ / cetat", sort: ["RELEVANCE", "DATE_DESC", "DATE_ASC"], defaultTarget: "ALL", targets : "ALL, TITLE, NUM_DEC, ABSTRATES, TEXTE"};
This decision will be made public as was deliberation no 2020-012 of December 7, 2020.
searchConfigs.push (config);


var config = {base: "JURI", value: "juri", url: "\ / search \ / juri", sort: ["RELEVANCE", "DATE_DESC", "DATE_ASC"], defaultTarget: "ALL", targets : "ALL, TITLE, NUM_AFFAIRE, ABSTRATES, TEXTE"};
FOR THESE REASONS
searchConfigs.push (config);


var config = {base: "JUFI", value: "jufi", url: "\ / search \ / jufi", sort: ["RELEVANCE", "DATE_DESC", "DATE_ASC"], defaultTarget: "ALL", targets : "ALL, TITLE, NUM_DEC, ABSTRATES, TEXTE"};
The restricted formation of the CNIL, after having deliberated, decides:
searchConfigs.push (config);


var config = {base: "KALI", value: "kali", url: "\ / search \ / kali", sort: ["RELEVANCE"], defaultTarget: "ALL", targets: "ALL, TITLE, ARTICLE, IDCC "};
- that there is no need for on-call liquidation;
searchConfigs.push (config);


var config = {base: "CNIL", value: "cnil", url: "\ / search \ / cnil", sort: ["RELEVANCE"], defaultTarget: "ALL", targets: "ALL, TITLE, NOR, NUM_DELIB "};
- make public, on the CNIL website and on the Légifrance website, its deliberation, which will no longer identify the companies by name as of December 11, 2022.
searchConfigs.push (config);


var config = {base: "ALL", value: "all", url: "\ / search \ / all", sort: ["RELEVANCE"], defaultTarget: "ALL", targets: "ALL, TITLE"};
Le président
searchConfigs.push (config);


var typesSearch = [];
Alexandre LINDEN
 
 
var type = {value: "ALL", proximity: true};
typesSearch.push (type);
 
var type = {value: "EXACT", proximity: false};
typesSearch.push (type);
 
var type = {value: "ONE", proximity: false};
typesSearch.push (type);
 
var type = {value: "EXCEPT", proximity: false};
typesSearch.push (type);
 
var type = {value: "EXACTEXCEPT", proximity: false};
typesSearch.push (type);
 
 
var tabTarget = [];
 
 
/ *]]> * /
    In all fields Select a search field In all fields In titles In tables of contents In NORD In text numbers In deliberation numbers In decision numbers In article numbers In article contents In names of ministries In visas In notices In notices visas or notices In the preparatory work In the signatures In the notices In the case numbers In the abstracts In the summaries In the contents of the texts In the ECLI In the numbers of referred laws In the types of decisions rendered In the internal numbers In the OJ or BOD publication references In the summaries In the texts of references In the titles of referred laws In the company names In the keywords In the IDCCEx. : L. 121-1, CGI, 10-15056, fraud, protected adults Tuesday 04 May 2021 Deliberation of the restricted committee n ° SAN-2021-004 of April 30, 2021 relating to the injunction pronounced against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED by deliberation n ° 2020-012 of December 7, 2020 The Commission National Data Protection Authority, gathered in its restricted formation composed of Messrs Alexandre LINDEN, President, and Philippe-Pierre CABOURDIN, Vice-President, and Ladies Anne DEBET and Christine MAUGÜE, members; Having regard to Regulation (EU) 2016 / 679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of personal data and the free movement of such data; Having regard to Law No. 78-17 of January 6, 1978 as amended relating to data processing, files and freedoms, in particular articles 20 and following; Having regard to decree no 2019-536 of 29 May 2019 taken for the application of the law
No 78-17 of 6 January 1978 as amended relating to data processing, files and freedoms; Considering deliberation no 2013-175 of 4 July 2013 adopting the internal regulations of the National Commission for Data Processing and Freedoms; Having regard to deliberation no 2020-012 of December 7, 2020 pronouncing a sanction against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED; Considering the elements transmitted by the company GOOGLE IRELAND LIMITED on December 18, 2020 and March 30, 2021; Having regard to the other documents of the file; After deliberation, adopted the following decision: I. Facts and procedure Deliberation No. 2020-012 of 7 December 2020 ordered the companies GOOGLE LLC and GOOGLE IRELAND LIMITED to: bring the processing into conformity with the obligations resulting from Article 82 of the Data Protection Act and, in particular, to inform the persons concerned in advance and in a clear and complete manner, for example on the information banner on the home page of the google.fr site: - the purposes of all cookies subject to consent, - the means at their disposal to refuse them. This injunction was accompanied by a fine of 100,000 euros per day of delay at the end of a period three months following the notification of the deliberation, the proof of the compliance must be sent to the restricted body within this period.On December 18, 2020, the company GOOGLE IRELAND LIMITED sent a letter to the CNIL in which it presented the changes that it planned to deploy on the google.fr website by the end of February 2021 and to which the CNIL services responded on February 17, 2021. On March 30, 2021, within the time limit set by the deliberation , the company GOOGLE IRELAND LIMITED sent the restricted party information in order to justify its compliance. II. Reasons for the decision The restricted party notes that it emerges from the information provided in the response letter of March 30, 20 21 that people visiting the google.fr site are now clearly and completely informed of all the purposes of cookies subject to consent and of the means made available to them to refuse them, through the information banner displayed on their arrival on the site. Consequently, the restricted panel considers that the companies GOOGLE LLC and GOOGLE IRELAND LIMITED have satisfied the injunction within the allotted time. This decision will be made public as had been deliberation no. 2020-012 of December 7, 2020 FOR THESE REASONS The restricted formation of the CNIL, after having deliberated, decides: - that there is no need for a penalty payment; - to make public, on the website of the CNIL and on the Légifrance website, its deliberation, which will no longer identify the companies by name as of December 11, 2022.
/ * <! [CDATA [* /
// Creation of a tag with sending in secure mode.
var tag = tagAtinternet;
// Marking the page with its level 2.
tag.page.set ({
level2: '54 '
});
// Send the hit.
tag.dispatch ();
/ *]]> * /
Return to the top of the page The National Commission for Informatics and Freedoms, meeting in its restricted formation composed of Messrs Alexandre LINDEN, President, and Philippe-Pierre CABOURDIN, Vice-President, and Ms Anne DEBET and Christine MAUGÜE, members; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of personal data and the free movement of such data; Having regard to Act No. 78-17 of 6 January 1978 as amended relating to data processing, files and freedoms, in particular articles 20 and following; Having regard to decree no 2019-536 of 29 May 2019 taken for the application of the law
No 78-17 of 6 January 1978 as amended relating to data processing, files and freedoms; Considering deliberation no 2013-175 of 4 July 2013 adopting the internal regulations of the National Commission for Data Processing and Freedoms; Having regard to deliberation no 2020-012 of December 7, 2020 pronouncing a sanction against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED; Considering the elements transmitted by the company GOOGLE IRELAND LIMITED on December 18, 2020 and March 30, 2021; Having regard to the other documents of the file; After deliberation, adopted the following decision: I. Facts and procedure Deliberation No. 2020-012 of 7 December 2020 ordered the companies GOOGLE LLC and GOOGLE IRELAND LIMITED to: bring the processing into conformity with the obligations resulting from Article 82 of the Data Protection Act and, in particular, to inform the persons concerned in advance and in a clear and complete manner, for example on the information banner on the home page of the google.fr site: - the purposes of all cookies subject to consent, - the means at their disposal to refuse them. This injunction was accompanied by a fine of 100,000 euros per day of delay at the end of a period three months following the notification of the deliberation, the proof of the compliance must be sent to the restricted body within this period.On December 18, 2020, the company GOOGLE IRELAND LIMITED sent a letter to the CNIL in which it presented the changes that it planned to deploy on the google.fr website by the end of February 2021 and to which the CNIL services responded on February 17, 2021. On March 30, 2021, within the time limit set by the deliberation , the company GOOGLE IRELAND LIMITED sent the restricted party information in order to justify its compliance. II. Reasons for the decision The restricted party notes that it emerges from the information provided in the response letter of March 30, 20 21 that people visiting the google.fr site are now clearly and completely informed of all the purposes of cookies subject to consent and of the means made available to them to refuse them, through the information banner displayed on their arrival on the site. Consequently, the restricted panel considers that the companies GOOGLE LLC and GOOGLE IRELAND LIMITED have satisfied the injunction within the allotted time. This decision will be made public as had been deliberation no. 2020-012 of December 7, 2020 FOR THESE REASONS The restricted formation of the CNIL, after having deliberated, decides: - that there is no need for a penalty payment; - to make public, on the website of the CNIL and on the Légifrance website, its deliberation, which will no longer identify the companies by name as of December 11, 2022 The president Alexandre LINDEND San-2021-004 deliberation of April 30, 2021 San-2021-004 deliberation of April 30, 2021
</pre>
</pre>

Latest revision as of 17:11, 6 December 2023

CNIL - SAN-2021-004
LogoFR.png
Authority: CNIL (France)
Jurisdiction: France
Relevant Law: Article 7 GDPR
Article 5(3) e-Privacy Directive
Articles 20 et seq. loi no 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés
Décret no 2019-536 du 29 mai 2019 pris pour l'application de la loi no 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés
Articles 20 et seq. loi no 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés
Type: Other
Outcome: n/a
Started:
Decided: 30.04.2021
Published: 04.05.2021
Fine: None
Parties: GOOGLE LLC
GOOGLE IRELAND LIMITED
National Case Number/Name: SAN-2021-004
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): French
Original Source: CNIL (in FR)
Initial Contributor: n/a

Following their decision to fine Google €100,000,000 for not complying with the cookies regulation, the CNIL accepted Google's adjustments and decided to close the case. However, the DPA stated that this only refers to the precautionary measures taken in their original decision, and reserved the right to further analyze Google compliance with the cookies regulation and the latest CNIL guidelines on the matter.

English Summary

Facts

On 7 December 2020, the CNIL fined Google €100,000,000 for not complying with the cookies regulation.

The CNIL had also given Google a limited time to adapt their cookies settings to the current regulation, with a daily fine of €100,000 in case they did not carry out the necessary adjustments to start complying within the three following months.

On 18 December 2020, Google sent a letter to the CNIL informing of their plan for compliance. After the CNIL's answer, on 30 March 2021 Google delivered to the CNIL the necessary information showing their adjustments for compliance.

Holding

The CNIL accepted Google's reply on their adjustments, considering that the cookie banner and the cookies mechanisms used by google.fr were now sufficiently clear and provided adequate information about the cookies they use, including the purposes of the processing and information about how to reject them.

Therefore, the CNIL decided to close the case. However, the authority stated that this only refers to the precautionary measures took in their original decision, and that they reserve the right to further analysis of Google's compliance with the cookies regulation and their recommendation issued on 17 September 2020, and to initiate a new sanctioning proceeding if necessary.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details. 

Deliberation of restricted committee n ° SAN-2021-004 of April 30, 2021 relating to the injunction pronounced against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED by deliberation n ° 2020-012 of December 7, 2020

The National Commission for Informatics and Freedoms, meeting in its restricted formation composed of Messrs Alexandre LINDEN, President, and Philippe-Pierre CABOURDIN, Vice-President, and Ladies Anne DEBET and Christine MAUGÜE, members;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of personal data and the free movement of such data;

Considering the law n ° 78-17 of January 6, 1978 modified relating to data processing, files and freedoms, in particular its articles 20 and following;

Having regard to decree no 2019-536 of 29 May 2019 taken for the application of the law
No. 78-17 of 6 January 1978 as amended relating to data processing, files and freedoms;

Having regard to deliberation no 2013-175 of 4 July 2013 adopting the internal regulations of the National Commission for Informatics and Freedoms;

Having regard to deliberation no 2020-012 of December 7, 2020 pronouncing a sanction against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED;

Considering the elements transmitted by the company GOOGLE IRELAND LIMITED on December 18, 2020 and March 30, 2021;

Having regard to the other documents in the file;

After deliberation, adopted the following decision:

I. Facts and procedure

Deliberation No. 2020-012 of December 7, 2020 ordered the companies GOOGLE LLC and GOOGLE IRELAND LIMITED to:

bring the processing into line with the obligations resulting from Article 82 of the Data Protection Act and, in particular, to inform the persons concerned in advance and in a clear and complete manner, for example on the information banner on the home page of the google.fr site:

- the purposes of all cookies subject to consent,

- the means at their disposal to refuse them.

This injunction was accompanied by a fine of 100,000 euros per day of delay at the end of a period of three months following the notification of the deliberation, the supporting documents of the compliance having to be sent to the restricted formation in this case. time limit.

On December 18, 2020, the company GOOGLE IRELAND LIMITED sent a letter to the CNIL in which it presented the changes it planned to deploy on the google.fr website by the end of February 2021 and to which the services of the CNIL responded on February 17, 2021.

On March 30, 2021, within the time limit set by the deliberation, the company GOOGLE IRELAND LIMITED sent the restricted formation elements in order to justify its compliance.

II.Reasons for the decision

The restricted committee notes that it emerges from the elements provided in the response letter of March 30, 2021 that people visiting the google.fr site are now clearly and completely informed of all the purposes of cookies subject to consent. and the means available to them to refuse them, through the information banner displayed on their arrival on the site.

Consequently, the restricted committee considers that the companies GOOGLE LLC and GOOGLE IRELAND LIMITED have satisfied the injunction within the allotted time.

This decision will be made public as was deliberation no 2020-012 of December 7, 2020.

FOR THESE REASONS

The restricted formation of the CNIL, after having deliberated, decides:

- that there is no need for on-call liquidation;

- make public, on the CNIL website and on the Légifrance website, its deliberation, which will no longer identify the companies by name as of December 11, 2022.

Le président

Alexandre LINDEN
Retrieved from "https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2021-004&oldid=37359"
Creative Commons Attribution-NonCommercial-ShareAlike
Powered by MediaWiki