CNIL (France) - SAN-2021-004
From GDPRhub
| CNIL - SAN-2021-004 | |
|---|---|
 | |
| Authority: | CNIL (France) |
| Jurisdiction: | France |
| Relevant Law: | Article 7 GDPR Article 5(3) e-Privacy Directive Articles 20 et seq. loi no 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés Décret no 2019-536 du 29 mai 2019 pris pour l'application de la loi no 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés Articles 20 et seq. loi no 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés |
| Type: | Other |
| Outcome: | n/a |
| Started: | |
| Decided: | 30.04.2021 |
| Published: | 04.05.2021 |
| Fine: | None |
| Parties: | GOOGLE LLC GOOGLE IRELAND LIMITED |
| National Case Number/Name: | SAN-2021-004 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | French |
| Original Source: | CNIL (in FR) |
| Initial Contributor: | n/a |
Following their decision to fine Google €100,000,000 for not complying with the cookies regulation, the CNIL accepted Google's adjustments and decided to close the case. However, the DPA stated that this only refers to the precautionary measures taken in their original decision, and reserved the right to further analyze Google compliance with the cookies regulation and the latest CNIL guidelines on the matter.
English Summary
Facts
On 7 December 2020, the CNIL fined Google €100,000,000 for not complying with the cookies regulation.
The CNIL had also given Google a limited time to adapt their cookies settings to the current regulation, with a daily fine of €100,000 in case they did not carry out the necessary adjustments to start complying within the three following months.
On 18 December 2020, Google sent a letter to the CNIL informing of their plan for compliance. After the CNIL's answer, on 30 March 2021 Google delivered to the CNIL the necessary information showing their adjustments for compliance.
Holding
The CNIL accepted Google's reply on their adjustments, considering that the cookie banner and the cookies mechanisms used by google.fr were now sufficiently clear and provided adequate information about the cookies they use, including the purposes of the processing and information about how to reject them.
Therefore, the CNIL decide to close this case. However, the authority stated that this only refers to the precautionary measures took in their original decision, and that they reserve the right to further analyze Google compliance with the cookies regulation and their recommendation issued on 17 September 2020, and to start a new sanctioning proceeding if necessary.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the French original. Please refer to the French original for more details.
Tuesday 04 May 2021 Deliberation of the restricted committee n ° SAN-2021-004 of April 30, 2021 relating to the injunction pronounced against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED by deliberation n ° 2020-012 of December 7, 2020 The Commission National Data Protection Authority, gathered in its restricted formation composed of Messrs Alexandre LINDEN, President, and Philippe-Pierre CABOURDIN, Vice-President, and Ladies Anne DEBET and Christine MAUGÜE, members; Having regard to Regulation (EU) 2016 / 679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of personal data and the free movement of such data; Having regard to Law No. 78-17 of January 6, 1978 as amended relating to data processing, files and freedoms, in particular articles 20 and following; Having regard to decree no 2019-536 of 29 May 2019 taken for the application of the law No 78-17 of 6 January 1978 as amended relating to data processing, files and freedoms; Considering deliberation no 2013-175 of 4 July 2013 adopting the internal regulations of the National Commission for Data Processing and Freedoms; Having regard to deliberation no 2020-012 of December 7, 2020 pronouncing a sanction against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED; Considering the elements transmitted by the company GOOGLE IRELAND LIMITED on December 18, 2020 and March 30, 2021; Having regard to the other documents of the file; After deliberation, adopted the following decision: I. Facts and procedure Deliberation No. 2020-012 of 7 December 2020 ordered the companies GOOGLE LLC and GOOGLE IRELAND LIMITED to: bring the processing into conformity with the obligations resulting from Article 82 of the Data Protection Act and, in particular, to inform the persons concerned in advance and in a clear and complete manner, for example on the information banner on the home page of the google.fr site: - the purposes of all cookies subject to consent, - the means at their disposal to refuse them. This injunction was accompanied by a fine of 100,000 euros per day of delay at the end of a period three months following the notification of the deliberation, the proof of the compliance must be sent to the restricted body within this period.On December 18, 2020, the company GOOGLE IRELAND LIMITED sent a letter to the CNIL in which it presented the changes that it planned to deploy on the google.fr website by the end of February 2021 and to which the CNIL services responded on February 17, 2021. On March 30, 2021, within the time limit set by the deliberation , the company GOOGLE IRELAND LIMITED sent the restricted party information in order to justify its compliance. II. Reasons for the decision The restricted party notes that it emerges from the information provided in the response letter of March 30, 20 21 that people visiting the google.fr site are now clearly and completely informed of all the purposes of cookies subject to consent and of the means made available to them to refuse them, through the information banner displayed on their arrival on the site. Consequently, the restricted panel considers that the companies GOOGLE LLC and GOOGLE IRELAND LIMITED have satisfied the injunction within the allotted time. This decision will be made public as had been deliberation no. 2020-012 of December 7, 2020 FOR THESE REASONS The restricted formation of the CNIL, after having deliberated, decides: - that there is no need for a penalty payment; - to make public, on the website of the CNIL and on the Légifrance website, its deliberation, which will no longer identify the companies by name as of December 11, 2022. Return to the top of the page The National Commission for Informatics and Freedoms, meeting in its restricted formation composed of Messrs Alexandre LINDEN, President, and Philippe-Pierre CABOURDIN, Vice-President, and Ms Anne DEBET and Christine MAUGÜE, members; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of personal data and the free movement of such data; Having regard to Act No. 78-17 of 6 January 1978 as amended relating to data processing, files and freedoms, in particular articles 20 and following; Having regard to decree no 2019-536 of 29 May 2019 taken for the application of the law No 78-17 of 6 January 1978 as amended relating to data processing, files and freedoms; Considering deliberation no 2013-175 of 4 July 2013 adopting the internal regulations of the National Commission for Data Processing and Freedoms; Having regard to deliberation no 2020-012 of December 7, 2020 pronouncing a sanction against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED; Considering the elements transmitted by the company GOOGLE IRELAND LIMITED on December 18, 2020 and March 30, 2021; Having regard to the other documents of the file; After deliberation, adopted the following decision: I. Facts and procedure Deliberation No. 2020-012 of 7 December 2020 ordered the companies GOOGLE LLC and GOOGLE IRELAND LIMITED to: bring the processing into conformity with the obligations resulting from Article 82 of the Data Protection Act and, in particular, to inform the persons concerned in advance and in a clear and complete manner, for example on the information banner on the home page of the google.fr site: - the purposes of all cookies subject to consent, - the means at their disposal to refuse them. This injunction was accompanied by a fine of 100,000 euros per day of delay at the end of a period three months following the notification of the deliberation, the proof of the compliance must be sent to the restricted body within this period.On December 18, 2020, the company GOOGLE IRELAND LIMITED sent a letter to the CNIL in which it presented the changes that it planned to deploy on the google.fr website by the end of February 2021 and to which the CNIL services responded on February 17, 2021. On March 30, 2021, within the time limit set by the deliberation , the company GOOGLE IRELAND LIMITED sent the restricted party information in order to justify its compliance. II. Reasons for the decision The restricted party notes that it emerges from the information provided in the response letter of March 30, 20 21 that people visiting the google.fr site are now clearly and completely informed of all the purposes of cookies subject to consent and of the means made available to them to refuse them, through the information banner displayed on their arrival on the site. Consequently, the restricted panel considers that the companies GOOGLE LLC and GOOGLE IRELAND LIMITED have satisfied the injunction within the allotted time. This decision will be made public as had been deliberation no. 2020-012 of December 7, 2020 FOR THESE REASONS The restricted formation of the CNIL, after having deliberated, decides: - that there is no need for a penalty payment; - to make public, on the website of the CNIL and on the Légifrance website, its deliberation, which will no longer identify the companies by name as of December 11, 2022 The president Alexandre LINDEND San-2021-004 deliberation of April 30, 2021 San-2021-004 deliberation of April 30, 2021
