Story image

Expert comment: Google fined US$57mil for GDPR breaches

22 Jan 2019

EU’s data privacy regulation, the General Data Protection Regulation (GDPR), has drawn first blood to the tune of €50mil.

French data privacy agency, the National Data Protection Commission (CNIL), has imposed the fine against Google for “lack of transparency, inadequate information, and lack of valid consent regarding ad personalisation”.

The committee examining the breaches found two types of breaches of the GDPR – a violation of the obligations of transparency and information and a violation of the obligation to have a legal basis for ads personalisation processing.

Violation of the obligations of transparency and information

The committee found that

  • The information provided by Google is not easily accessible for users
     
  • Essential information (data processing purposes, data storage periods, categories of personal data used for ad personalisation) is disseminated across several documents and complicated to obtain  
     
  • Some information is not always clear nor comprehensive
     
  • It is difficult for the user to fully understand the extent of the processing operations carried out by Google across its multitude of services and the way the data is processed and combined

Violation of the obligation to have a legal basis for ads personalisation processing

The committee found that

  • Google obtains a user’s consent to processing data for ad personalisation, but the consent is not validly obtained for two reasons

  • The first being that the users’ consent is not sufficiently informed, with the information being fragmented and not enabling users to be aware of their extent.

  • The collected consent is neither “specific” or “unambiguous” as required by the GDPR.

Experts say this is a clear signal that regulators will be enforcing the GDPR regulations and compliance is mandatory.

Proofpoint cybersecurity strategy SVP Ryan Kalember says, “This GDPR fine brings to light some vital lessons for other businesses observing this crisis from a distance.

“By becoming the highest-fined company since GDPR came into force, Google is now the black-and-white case study of ‘what could happen’ in the event of non-compliance.

“In a privacy-first world, companies must build a people-centric compliance strategy, which can only start by getting visibility into highly regulated data, the systems that process that data and identifying who within your business has access to that data.

“Many organisations are still unsure whether their GDPR compliance strategy is 100 percent fit for purpose, but this incident signals that long gone are the days where privacy can be relegated to an IT or compliance effort: the magnitude of this fine clearly shows this is a business issue.

“Compliance professionals now have a use case to take to the board to secure any funding and resources they need to become GDPR compliant if their organisation isn’t today.”

Varonis sales engineering director Matt Lock says, “The new fine facing Google will quickly dispel any lingering doubts that the EU would go easy on companies found in violation of the GDPR.

“The news should be hitting companies like a cold shower. It’s not a stretch to say that a proverbial storm is gathering as privacy groups rally to their cause and seek to uphold major global companies as examples of lax privacy controls.

“The news should serve as an impetus to organisations that have yet to prioritise their GDPR compliance programmes and hoped to simply fly under the radar– their luck may be running out soon.”

How IBM’s acquisition of Red Hat could impact your business
The acquisition is pending regulatory approval, but IBM expects the deal to close in the second half of 2019. 
Data center colocation market to hit $90b in next five years
As data center services grow in popularity across enterprises large and small, the colocation market is seeing the benefits in market size.
Automation beginning to impact Aussie workforce
18% of those surveyed said automation has already impacted their job ‘significantly’, with their duties changing or their role becoming redundant.
OVH launches public cloud down under
OVH Public Cloud services is expanding to Australia out of two data centres - one in Sydney and one in Singapore.
Acer’s new programme and portal for partners
A simple and manageable programme designed to incentivise, recognise and reward commercial partner achievements.
Interview: Culture and cloud - the battle for cybersecurity
ESET CTO Juraj Malcho talks about the importance of culture in a cybersecurity strategy and the challenges and benefits of a world in the cloud.
In ongoing cloud war, Google to acquire data migration specialist
Google is currently behind AWS and Microsoft in the cloud battle, and it would seem this play is an attempt to claw some ground back.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.