CNIL (France) - SAN-2023-012

CNIL - SAN-2023-012
Authority:	CNIL (France)
Jurisdiction:	France
Relevant Law:	Article 5(3) of Direcitve 2002/58/EC
Type:	Other
Outcome:	n/a
Started:
Decided:	13.07.2023
Published:	01.08.2023
Fine:	n/a
Parties:	Google LLC Google Ireland Limited
National Case Number/Name:	SAN-2023-012
European Case Law Identifier:	n/a
Appeal:	n/a
Original Language(s):	French
Original Source:	CNIL (in FR)
Initial Contributor:	n/a

The French DPA found that Google's cookie banner system was GDPR compliant following the reevaluation of an order issued against the companies Google LLC and Google Ireland Limited in decision SAN-2021-023 of 31 December 2021 for non-compliant cookie banners.

English Summary

Facts

This decision follows from a previous decision of the French DPA (SAN 2021-023 of 31 December 2021), in which said DPA fined Google LLC €90,000,000 and Google Ireland Limited €60,000,000 for violating Article 82 of the French Data Protection Act. This Act transposes the ePrivacy Directive into domestic French law. Article 82 of the French Data Protection Act is the national equivalent to Article 5(3) of the ePrivacy Directive (2002/58/EC), which stipulates that the storing of user information or the gaining of access to information already stored, is only permitted on the condition that the user has already given their informed consent. The French DPA had fined Google LLC and Google Ireland Limited in decision SAN 2021-023 for failing to offer users a way of rejecting cookies. It ordered Google to bring its processing activities into compliance and imposed an additional periodic fine of €100,000 per day if Google failed to bring its processing activities into compliance within 3 months.

On 24 April 2022, Google sent the French DPA its proposed cookie amendments, which included a button titled "reject all." Between April and June 2022, Google sent further information to the French DPA, and on 5 August 2022, the French DPA re-investigated the matter to ensure that the updated cookie system was compliant. On 25 January 2023 the French DPA requested further information from Google on their system, which Google provided on 28 April 2023.

Holding

The French DPA held that Google's updated cookie system was compliant, as the implementation of the "reject all" button offered a means of users refusing the storage of and access to their information, pursuant to Article 82 of the French Data Protection Act.

Consequently, the French DPA decided to liquidate the periodic fine.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the French original. Please refer to the French original for more details.

Deliberation of the restricted panel no. SAN-2023-12 of July 13, 2023 relating to the injunction pronounced against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED by deliberation no. SAN-2021-023 of December 31, 2021

The National Commission for Information Technology and Freedoms, gathered in its restricted formation composed of Mr. Philippe-Pierre CABOURDIN, vice-president, Mrs. Anne DEBET and Christine MAUGÜÉ, and Messrs. Alain DRU and Bertrand du MARAIS, members;

Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of personal data and the free movement of such data;

Having regard to law n° 78-17 of January 6, 1978 as amended relating to data processing, files and freedoms, in particular its articles 20 et seq.;

Having regard to Decree No. 2019-536 of May 29, 2019 as amended taken for the application of Law No. 78-17 of January 6, 1978 relating to computing, files and freedoms;

Having regard to deliberation no. 2013-175 of July 4, 2013 adopting the internal regulations of the National Commission for Information Technology and Liberties;

Having regard to deliberation no. SAN-2021-023 of December 31, 2021 adopted by the restricted panel against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED;

Having regard to the elements transmitted by the companies GOOGLE LLC and GOOLE IRELAND LIMITED on April 4, April 19, May 25 and June 15, 2022, to demonstrate their compliance with the injunction;

Having regard to the letter of August 5, 2022, by which the president of the restricted panel asked the rapporteur to intervene again in the procedure for the purpose of examining these elements;

Having regard to the additional request from Ms. Valérie PEUGEOT, commissioner rapporteur, notified to the boards of the companies GOOGLE LLC and GOOGLE IRELAND LIMITED on January 25, 2023;

Having regard to the letter dated April 28, 2023, in response to the additional request, sent by the companies GOOGLE LLC and GOOGLE IRELAND LIMITED;

Considering the other documents in the file;

After deliberating at the meeting of July 13, 2023, adopted the following decision:

I. FACTS AND PROCEDURE

1. Decision no SAN-2021-023 of December 31, 2021, notified to the company GOOGLE LLC on January 14, 2022 and on January 17, 2022 to the company GOOGLE IRELAND LIMITED, ordered the companies GOOGLE LLC and GOOGLE IRELAND LIMITED (hereinafter after “Google”) of:

"to modify, on the websites "google.fr" and "youtube.com", the terms of obtaining the consent of users located in France to the operations of reading and/or writing information in their terminal, by offering a means of refusing these operations presenting a simplicity equivalent to the mechanism provided for their acceptance, in order to guarantee the freedom of their consent".

2. This injunction was accompanied by a penalty of one hundred thousand euros (100,000) euros per day of delay at the end of a period of three months following notification of the deliberation of the restricted formation, the supporting documents for the in compliance must be sent to the restricted training within this deadline.

3. On April 4, 2022, within the deadline set by the deliberation, Google sent the president of the restricted training elements with a view to justifying its compliance, presenting the measures that it intended to implement from mid -April 2022 on YouTube and at the end of April or in the first weeks of May 2022 for Google Search. The modifications consisted of adapting the user journey so that the pop-up windows relating to cookies, which appear when the user goes to the companies' websites, now include a refusal button entitled "Refuse all".

4. On April 19, May 25 and June 15, 2022, Google sent to the president of the restricted training the supporting documents attesting to the deployment on the websites "google.fr" and "youtube.com" of these new pop-up windows relating to cookies .

5. By letter dated August 5, 2022, the president of the restricted panel asked the rapporteur to intervene again for the purposes of examining these elements, on the basis of article 44 of decree no. 2019-536 of May 29, 2019, to ensure the effectiveness of the refusal mechanism implemented by the company.

6. For this purpose, after an analysis notified to Google on January 25, 2023, the rapporteur asked Google to provide her, within 2 months, with additional information.

7. By letter dated April 28, 2023, Google provided the requested details.

II. REASONS FOR DECISION

8. The restricted training notes that it appears from the elements provided by the company in its various letters that people visiting the websites "google.fr" and "youtube.com" are now offered a means of refusing operations reading and/or writing information in their terminal presenting a simplicity equivalent to the mechanism provided for their acceptance.

9. The proposed terms make it possible to guarantee the freedom of user consent, the restricted panel considers that the companies GOOGLE LLC and GOOGLE IRELAND LIMITED have complied with the injunction within the allotted time limit.

FOR THESE REASONS

The restricted formation of the CNIL, after having deliberated, decides:

- to say that there is no need to liquidate the penalty;

- to make public, on the CNIL website and on the Légifrance website, this deliberation which will no longer identify the companies by name at the end of a period of two years, the starting point being the publication of the deliberation no. SAN-2021-023 of December 31, 2021.

The vice president

Philippe-Pierre CABOURDIN