Story image

Expert comment: Google fined US$57mil for GDPR breaches

22 Jan 2019

EU’s data privacy regulation, the General Data Protection Regulation (GDPR), has drawn first blood to the tune of €50mil.

French data privacy agency, the National Data Protection Commission (CNIL), has imposed the fine against Google for “lack of transparency, inadequate information, and lack of valid consent regarding ad personalisation”.

The committee examining the breaches found two types of breaches of the GDPR – a violation of the obligations of transparency and information and a violation of the obligation to have a legal basis for ads personalisation processing.

Violation of the obligations of transparency and information

The committee found that

  • The information provided by Google is not easily accessible for users
     
  • Essential information (data processing purposes, data storage periods, categories of personal data used for ad personalisation) is disseminated across several documents and complicated to obtain  
     
  • Some information is not always clear nor comprehensive
     
  • It is difficult for the user to fully understand the extent of the processing operations carried out by Google across its multitude of services and the way the data is processed and combined

Violation of the obligation to have a legal basis for ads personalisation processing

The committee found that

  • Google obtains a user’s consent to processing data for ad personalisation, but the consent is not validly obtained for two reasons

  • The first being that the users’ consent is not sufficiently informed, with the information being fragmented and not enabling users to be aware of their extent.

  • The collected consent is neither “specific” or “unambiguous” as required by the GDPR.

Experts say this is a clear signal that regulators will be enforcing the GDPR regulations and compliance is mandatory.

Proofpoint cybersecurity strategy SVP Ryan Kalember says, “This GDPR fine brings to light some vital lessons for other businesses observing this crisis from a distance.

“By becoming the highest-fined company since GDPR came into force, Google is now the black-and-white case study of ‘what could happen’ in the event of non-compliance.

“In a privacy-first world, companies must build a people-centric compliance strategy, which can only start by getting visibility into highly regulated data, the systems that process that data and identifying who within your business has access to that data.

“Many organisations are still unsure whether their GDPR compliance strategy is 100 percent fit for purpose, but this incident signals that long gone are the days where privacy can be relegated to an IT or compliance effort: the magnitude of this fine clearly shows this is a business issue.

“Compliance professionals now have a use case to take to the board to secure any funding and resources they need to become GDPR compliant if their organisation isn’t today.”

Varonis sales engineering director Matt Lock says, “The new fine facing Google will quickly dispel any lingering doubts that the EU would go easy on companies found in violation of the GDPR.

“The news should be hitting companies like a cold shower. It’s not a stretch to say that a proverbial storm is gathering as privacy groups rally to their cause and seek to uphold major global companies as examples of lax privacy controls.

“The news should serve as an impetus to organisations that have yet to prioritise their GDPR compliance programmes and hoped to simply fly under the radar– their luck may be running out soon.”

GoCardless to double A/NZ team by end of year
With a successful E round of investment and continuing organic growth globally, the debit network platform company aims to expand its local presence.
NZ’s Maori innovators are on the rise
“More iwi investors need to recognise that these sectors will provide the high-value jobs our children need."
Phone ringing? This biohack wants you to bite down and ChewIt
So your phone’s ringing, but instead of swiping right or pushing a Bluetooth button you bite down on a tiny piece of tech that sits in your mouth.
How big data can revolutionise NZ’s hospitals
Miya Precision is being used across 17 wards and the emergency department at Palmerston North Hospital.
Time's up, tax dodgers: Multinational tech firms may soon pay their dues
Multinational tech and digital services firms may no longer have a free tax pass to operate in New Zealand. 
Spark’s new IoT network reaches 98% of New Zealand
Spark is the first company to confirm the nationwide completion of a Cat-M1 network in New Zealand.
WhatsApp users warned to change voicemail PINs
Attackers are allegedly gaining access to users’ WhatsApp accounts by using the default voicemail PIN to access voice authentication codes.
Robots to the fore – Key insights for New Zealand Business into RPA in 2019
From making artificial intelligence a business reality to closer ties to human colleagues, robotic process automation is gearing up for a strong 2019.