Google Fined $50 Million For Data Violation

Google's use of data to personalize advertisements could cost it more than $50 million. It's been fined for breaching European rules on data protection.

The fine comes under the General Data Protection Regulation (GDPR), a set of rules drawn up by the European Union and covering activity in 27 countries. It follows a complaint filed by privacy groups the day the rules came into force last May.

The breach is all to do with Google's obligation to get user consent before using personal data to provide targeted ads - one of the key aspects of the company's business. Although Google does allow users to opt out of some data use, French regulators said it had fallen short in two ways.

Consent Was Not Clear

The first was that users couldn't give the required "clear consent" because the details of what Google did with data were spread out over multiple documents, making it difficult to "understand the extent of the processing operations."

The second was that Google's policy of a "pre-ticked" consent box when setting up an account wasn't adequate, despite user's being able to opt out. That's because this consent box is an "all-or-nothing" covering the use of data in multiple ways. GDPR says consent must specifically cover a particular purpose.

Fine Could Have Been Way Higher

The regulator noted that not only had Google breached the rules at the time of the complaint, but was yet to change its policies. It fined Google €50 million (US$56 million). While that's a hefty amount, it's nowhere close to the legal maximum. GDPR violations can mean a penalty of up to four percent of annual global turnover, which would have run into the billions for Google. (Source: theverge.com)

Google hasn't admitted any wrongdoing and says it will review its options. It issued a statement, stating that "people expect high standards of transparency and control from us. We're deeply committed to meeting those expectations and the consent requirements of the GDPR." (Source: bbc.co.uk)

What's Your Opinion?

Do the rules seem fair to you? Do you feel you understand what Google does with your personal data? Is it right that maximum fines be based on a company's turnover rather than being a fixed amount?