CNIL (France) - SAN-2021-004

CNIL - SAN-2021-004
Authority:	CNIL (France)
Jurisdiction:	France
Relevant Law:	Article 7 GDPR Article 5(3) e-Privacy Directive Articles 20 et seq. loi no 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés Décret no 2019-536 du 29 mai 2019 pris pour l'application de la loi no 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés Articles 20 et seq. loi no 78-17 du 6 janvier 1978 modifiée relative à l'informatique, aux fichiers et aux libertés
Type:	Other
Outcome:	n/a
Started:
Decided:	30.04.2021
Published:	04.05.2021
Fine:	None
Parties:	GOOGLE LLC GOOGLE IRELAND LIMITED
National Case Number/Name:	SAN-2021-004
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	CNIL (in FR)
Initial Contributor:	n/a

Following their decision to fine Google €100,000,000 for not complying with the cookies regulation, the CNIL accepted Google's adjustments and decided to close the case. However, the DPA stated that this only refers to the precautionary measures taken in their original decision, and reserved the right to further analyze Google compliance with the cookies regulation and the latest CNIL guidelines on the matter.

English Summary

Facts

On 7 December 2020, the CNIL fined Google €100,000,000 for not complying with the cookies regulation.

The CNIL had also given Google a limited time to adapt their cookies settings to the current regulation, with a daily fine of €100,000 in case they did not carry out the necessary adjustments to start complying within the three following months.

On 18 December 2020, Google sent a letter to the CNIL informing of their plan for compliance. After the CNIL's answer, on 30 March 2021 Google delivered to the CNIL the necessary information showing their adjustments for compliance.

Holding

The CNIL accepted Google's reply on their adjustments, considering that the cookie banner and the cookies mechanisms used by google.fr were now sufficiently clear and provided adequate information about the cookies they use, including the purposes of the processing and information about how to reject them.

Therefore, the CNIL decided to close the case. However, the authority stated that this only refers to the precautionary measures took in their original decision, and that they reserve the right to further analysis of Google's compliance with the cookies regulation and their recommendation issued on 17 September 2020, and to initiate a new sanctioning proceeding if necessary.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

Deliberation of restricted committee n ° SAN-2021-004 of April 30, 2021 relating to the injunction pronounced against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED by deliberation n ° 2020-012 of December 7, 2020

The National Commission for Informatics and Freedoms, meeting in its restricted formation composed of Messrs Alexandre LINDEN, President, and Philippe-Pierre CABOURDIN, Vice-President, and Ladies Anne DEBET and Christine MAUGÜE, members;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of personal data and the free movement of such data;

Considering the law n ° 78-17 of January 6, 1978 modified relating to data processing, files and freedoms, in particular its articles 20 and following;

Having regard to decree no 2019-536 of 29 May 2019 taken for the application of the law
No. 78-17 of 6 January 1978 as amended relating to data processing, files and freedoms;

Having regard to deliberation no 2013-175 of 4 July 2013 adopting the internal regulations of the National Commission for Informatics and Freedoms;

Having regard to deliberation no 2020-012 of December 7, 2020 pronouncing a sanction against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED;

Considering the elements transmitted by the company GOOGLE IRELAND LIMITED on December 18, 2020 and March 30, 2021;

Having regard to the other documents in the file;

After deliberation, adopted the following decision:

I. Facts and procedure

Deliberation No. 2020-012 of December 7, 2020 ordered the companies GOOGLE LLC and GOOGLE IRELAND LIMITED to:

bring the processing into line with the obligations resulting from Article 82 of the Data Protection Act and, in particular, to inform the persons concerned in advance and in a clear and complete manner, for example on the information banner on the home page of the google.fr site:

- the purposes of all cookies subject to consent,

- the means at their disposal to refuse them.

This injunction was accompanied by a fine of 100,000 euros per day of delay at the end of a period of three months following the notification of the deliberation, the supporting documents of the compliance having to be sent to the restricted formation in this case. time limit.

On December 18, 2020, the company GOOGLE IRELAND LIMITED sent a letter to the CNIL in which it presented the changes it planned to deploy on the google.fr website by the end of February 2021 and to which the services of the CNIL responded on February 17, 2021.

On March 30, 2021, within the time limit set by the deliberation, the company GOOGLE IRELAND LIMITED sent the restricted formation elements in order to justify its compliance.

II.Reasons for the decision

The restricted committee notes that it emerges from the elements provided in the response letter of March 30, 2021 that people visiting the google.fr site are now clearly and completely informed of all the purposes of cookies subject to consent. and the means available to them to refuse them, through the information banner displayed on their arrival on the site.

Consequently, the restricted committee considers that the companies GOOGLE LLC and GOOGLE IRELAND LIMITED have satisfied the injunction within the allotted time.

This decision will be made public as was deliberation no 2020-012 of December 7, 2020.

FOR THESE REASONS

The restricted formation of the CNIL, after having deliberated, decides:

- that there is no need for on-call liquidation;

- make public, on the CNIL website and on the Légifrance website, its deliberation, which will no longer identify the companies by name as of December 11, 2022.

Le président

Alexandre LINDEN