CNIL (France) - SAN-2021-004

CNIL - SAN-2021-004
Authority:	CNIL (France)
Jurisdiction:	France
Relevant Law:	Article 7 GDPR Article 5(3) e-Privacy Directive Articles 20 et seq. loi no 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés Décret no 2019-536 du 29 mai 2019 pris pour l'application de la loi no 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés Articles 20 et seq. loi no 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés
Type:	Other
Outcome:	n/a
Started:
Decided:	30.04.2021
Published:	04.05.2021
Fine:	None
Parties:	GOOGLE LLC GOOGLE IRELAND LIMITED
National Case Number/Name:	SAN-2021-004
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	CNIL (in FR)
Initial Contributor:	n/a

Following their decision to fine Google €100,000,000 for not complying with the cookies regulation, the CNIL accepted Google's adjustments and decided to close the case.

English Summary

Facts

On 7 December 2020, the CNIL fined Google €100,000,000 for not complying with the cookies regulation.

The CNIL had also given Google a limited time to adapt their cookies settings to the current regulation, with a daily fine of €100,000 in case they did not carry out the necessary adjustments to start complying within the three following months.

On 18 December 2020, Google sent a letter to the CNIL informing of their plan for compliance. After the CNIL's answer, on 30 March 2021 Google delivered to the CNIL the necessary information showing their adjustments for compliance.

Holding

The CNIL accepted Google's reply on their adjustments, considering that the cookie banner and the cookies mechanisms used by google.fr were now sufficiently clear and provided adequate information about the cookies they use, including the purposes of the processing and information about how to reject them.

Therefore, the CNIL decide to close this case. They, however, only refers to the

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

HomeAbout the lawAuthoritiesIndependent administrative authoritiesDeliberation SAN-2021-004 of April 30, 2021Deliberation SAN-2021-004 of April 30, 2021Carry out a search in: All contentSelect a fund
Codes

Consolidated texts

Official newspaper

Circulars and Instructions

Constitutional case law

Administrative case law

Judicial case law

Financial case law

Branch agreements and collective agreements

Company agreements

CNIL

All contents

    / * <! [CDATA [* /

    var searchConfigs = [];
    


var config = {base: "CODE", value: "code", url: "\ / search \ / code", sort: ["RELEVANCE"], defaultTarget: "ALL", targets: "ALL, TITLE, ARTICLE, TABLE, NUM_ARTICLE "};
searchConfigs.push (config);

var config = {base: "LODA", value: "lawarticledecree", url: "\ / search \ / lois", sort: ["RELEVANCE", "SIGNATURE_DATE_DESC", "SIGNATURE_DATE_ASC", "PUBLICATION_DATE_DESC", "PUBLICATION_DATE_ASC"] , defaultTarget: "ALL", targets: "ALL, TITLE, NUM_ARTICLE, ARTICLE, VISA_NOTICE, NUM, NOR, SIGNATURE"};
searchConfigs.push (config);

var config = {base: "JORF", value: "jorf", url: "\ / search \ / jorf", sort: ["RELEVANCE", "SIGNATURE_DATE_DESC", "SIGNATURE_DATE_ASC", "PUBLICATION_DATE_DESC", "PUBLICATION_DATE_ASC"] , defaultTarget: "ALL", targets: "ALL, TITLE, NOR, NUM, NUM_ARTICLE, ARTICLE, VISA_NOTICE, SIGNATURE"};
searchConfigs.push (config);

var config = {base: "CIRC", value: "circ", url: "\ / search \ / circ", sort: ["RELEVANCE", "SIGNATURE_DATE_DESC", "SIGNATURE_DATE_ASC", "PUBLICATION_DATE_DESC", "PUBLICATION_DATE_ASC"] , defaultTarget: "ALL", targets: "ALL, TITLE, NOR"};
searchConfigs.push (config);

var config = {base: "ACCO", value: "acco", url: "\ / search \ / acco", sort: ["RELEVANCE", "SIGNATURE_DATE_DESC", "SIGNATURE_DATE_ASC"], defaultTarget: "ALL", targets : "ALL, RAISON_SOCIALE, IDCC, TITLE"};
searchConfigs.push (config);

var config = {base: "CONSTIT", value: "constit", url: "\ / search \ / constit", sort: ["RELEVANCE", "DATE_DESC", "DATE_ASC"], defaultTarget: "ALL", targets : "ALL, TITLE, NUM_DEC, TEXTE"};
searchConfigs.push (config);

var config = {base: "CETAT", value: "cetat", url: "\ / search \ / cetat", sort: ["RELEVANCE", "DATE_DESC", "DATE_ASC"], defaultTarget: "ALL", targets : "ALL, TITLE, NUM_DEC, ABSTRATES, TEXTE"};
searchConfigs.push (config);

var config = {base: "JURI", value: "juri", url: "\ / search \ / juri", sort: ["RELEVANCE", "DATE_DESC", "DATE_ASC"], defaultTarget: "ALL", targets : "ALL, TITLE, NUM_AFFAIRE, ABSTRATES, TEXTE"};
searchConfigs.push (config);

var config = {base: "JUFI", value: "jufi", url: "\ / search \ / jufi", sort: ["RELEVANCE", "DATE_DESC", "DATE_ASC"], defaultTarget: "ALL", targets : "ALL, TITLE, NUM_DEC, ABSTRATES, TEXTE"};
searchConfigs.push (config);

var config = {base: "KALI", value: "kali", url: "\ / search \ / kali", sort: ["RELEVANCE"], defaultTarget: "ALL", targets: "ALL, TITLE, ARTICLE, IDCC "};
searchConfigs.push (config);

var config = {base: "CNIL", value: "cnil", url: "\ / search \ / cnil", sort: ["RELEVANCE"], defaultTarget: "ALL", targets: "ALL, TITLE, NOR, NUM_DELIB "};
searchConfigs.push (config);

var config = {base: "ALL", value: "all", url: "\ / search \ / all", sort: ["RELEVANCE"], defaultTarget: "ALL", targets: "ALL, TITLE"};
searchConfigs.push (config);

var typesSearch = [];


var type = {value: "ALL", proximity: true};
typesSearch.push (type);

var type = {value: "EXACT", proximity: false};
typesSearch.push (type);

var type = {value: "ONE", proximity: false};
typesSearch.push (type);

var type = {value: "EXCEPT", proximity: false};
typesSearch.push (type);

var type = {value: "EXACTEXCEPT", proximity: false};
typesSearch.push (type);


var tabTarget = [];


/ *]]> * /
    In all fields Select a search field In all fields In titles In tables of contents In NORD In text numbers In deliberation numbers In decision numbers In article numbers In article contents In names of ministries In visas In notices In notices visas or notices In the preparatory work In the signatures In the notices In the case numbers In the abstracts In the summaries In the contents of the texts In the ECLI In the numbers of referred laws In the types of decisions rendered In the internal numbers In the OJ or BOD publication references In the summaries In the texts of references In the titles of referred laws In the company names In the keywords In the IDCCEx. : L. 121-1, CGI, 10-15056, fraud, protected adults Tuesday 04 May 2021 Deliberation of the restricted committee n ° SAN-2021-004 of April 30, 2021 relating to the injunction pronounced against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED by deliberation n ° 2020-012 of December 7, 2020 The Commission National Data Protection Authority, gathered in its restricted formation composed of Messrs Alexandre LINDEN, President, and Philippe-Pierre CABOURDIN, Vice-President, and Ladies Anne DEBET and Christine MAUGÜE, members; Having regard to Regulation (EU) 2016 / 679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of personal data and the free movement of such data; Having regard to Law No. 78-17 of January 6, 1978 as amended relating to data processing, files and freedoms, in particular articles 20 and following; Having regard to decree no 2019-536 of 29 May 2019 taken for the application of the law
No 78-17 of 6 January 1978 as amended relating to data processing, files and freedoms; Considering deliberation no 2013-175 of 4 July 2013 adopting the internal regulations of the National Commission for Data Processing and Freedoms; Having regard to deliberation no 2020-012 of December 7, 2020 pronouncing a sanction against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED; Considering the elements transmitted by the company GOOGLE IRELAND LIMITED on December 18, 2020 and March 30, 2021; Having regard to the other documents of the file; After deliberation, adopted the following decision: I. Facts and procedure Deliberation No. 2020-012 of 7 December 2020 ordered the companies GOOGLE LLC and GOOGLE IRELAND LIMITED to: bring the processing into conformity with the obligations resulting from Article 82 of the Data Protection Act and, in particular, to inform the persons concerned in advance and in a clear and complete manner, for example on the information banner on the home page of the google.fr site: - the purposes of all cookies subject to consent, - the means at their disposal to refuse them. This injunction was accompanied by a fine of 100,000 euros per day of delay at the end of a period three months following the notification of the deliberation, the proof of the compliance must be sent to the restricted body within this period.On December 18, 2020, the company GOOGLE IRELAND LIMITED sent a letter to the CNIL in which it presented the changes that it planned to deploy on the google.fr website by the end of February 2021 and to which the CNIL services responded on February 17, 2021. On March 30, 2021, within the time limit set by the deliberation , the company GOOGLE IRELAND LIMITED sent the restricted party information in order to justify its compliance. II. Reasons for the decision The restricted party notes that it emerges from the information provided in the response letter of March 30, 20 21 that people visiting the google.fr site are now clearly and completely informed of all the purposes of cookies subject to consent and of the means made available to them to refuse them, through the information banner displayed on their arrival on the site. Consequently, the restricted panel considers that the companies GOOGLE LLC and GOOGLE IRELAND LIMITED have satisfied the injunction within the allotted time. This decision will be made public as had been deliberation no. 2020-012 of December 7, 2020 FOR THESE REASONS The restricted formation of the CNIL, after having deliberated, decides: - that there is no need for a penalty payment; - to make public, on the website of the CNIL and on the Légifrance website, its deliberation, which will no longer identify the companies by name as of December 11, 2022.
/ * <! [CDATA [* /
// Creation of a tag with sending in secure mode.
var tag = tagAtinternet;
// Marking the page with its level 2.
tag.page.set ({
level2: '54 '
});
// Send the hit.
tag.dispatch ();
/ *]]> * /
Return to the top of the page The National Commission for Informatics and Freedoms, meeting in its restricted formation composed of Messrs Alexandre LINDEN, President, and Philippe-Pierre CABOURDIN, Vice-President, and Ms Anne DEBET and Christine MAUGÜE, members; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of personal data and the free movement of such data; Having regard to Act No. 78-17 of 6 January 1978 as amended relating to data processing, files and freedoms, in particular articles 20 and following; Having regard to decree no 2019-536 of 29 May 2019 taken for the application of the law
No 78-17 of 6 January 1978 as amended relating to data processing, files and freedoms; Considering deliberation no 2013-175 of 4 July 2013 adopting the internal regulations of the National Commission for Data Processing and Freedoms; Having regard to deliberation no 2020-012 of December 7, 2020 pronouncing a sanction against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED; Considering the elements transmitted by the company GOOGLE IRELAND LIMITED on December 18, 2020 and March 30, 2021; Having regard to the other documents of the file; After deliberation, adopted the following decision: I. Facts and procedure Deliberation No. 2020-012 of 7 December 2020 ordered the companies GOOGLE LLC and GOOGLE IRELAND LIMITED to: bring the processing into conformity with the obligations resulting from Article 82 of the Data Protection Act and, in particular, to inform the persons concerned in advance and in a clear and complete manner, for example on the information banner on the home page of the google.fr site: - the purposes of all cookies subject to consent, - the means at their disposal to refuse them. This injunction was accompanied by a fine of 100,000 euros per day of delay at the end of a period three months following the notification of the deliberation, the proof of the compliance must be sent to the restricted body within this period.On December 18, 2020, the company GOOGLE IRELAND LIMITED sent a letter to the CNIL in which it presented the changes that it planned to deploy on the google.fr website by the end of February 2021 and to which the CNIL services responded on February 17, 2021. On March 30, 2021, within the time limit set by the deliberation , the company GOOGLE IRELAND LIMITED sent the restricted party information in order to justify its compliance. II. Reasons for the decision The restricted party notes that it emerges from the information provided in the response letter of March 30, 20 21 that people visiting the google.fr site are now clearly and completely informed of all the purposes of cookies subject to consent and of the means made available to them to refuse them, through the information banner displayed on their arrival on the site. Consequently, the restricted panel considers that the companies GOOGLE LLC and GOOGLE IRELAND LIMITED have satisfied the injunction within the allotted time. This decision will be made public as had been deliberation no. 2020-012 of December 7, 2020 FOR THESE REASONS The restricted formation of the CNIL, after having deliberated, decides: - that there is no need for a penalty payment; - to make public, on the website of the CNIL and on the Légifrance website, its deliberation, which will no longer identify the companies by name as of December 11, 2022 The president Alexandre LINDEND San-2021-004 deliberation of April 30, 2021 San-2021-004 deliberation of April 30, 2021