CNIL closes Google cookies case after accepting compliance adjustments
On 7 December 2020, the CNIL fined Google €100,000,000 for not complying with the cookies regulation.
Status Not cited by any decision here yet
Original title: CNIL (France) - SAN-2021-004
Holding
The CNIL accepted Google's reply on their adjustments, considering that the cookie banner and the cookies mechanisms used by google.fr were now sufficiently clear and provided adequate information about the cookies they use, including the purposes of the processing and information about how to reject them. Therefore, the CNIL decided to close the case. However, the authority stated that this only refers to the precautionary measures took in their original decision, and that they reserve the right to further analysis of Google's compliance with the cookies regulation and their recommendation issued on 17 September 2020, and to initiate a new sanctioning proceeding if necessary.
From GDPRhub’s case note — a summary of the decision, not its own words. Read it in the text ↓
The CNIL had also given Google a limited time to adapt their cookies settings to the current regulation, with a daily fine of €100,000 in case they did not carry out the necessary adjustments to start complying within the three following months. On 18 December 2020, Google sent a letter to the CNIL informing of their plan for compliance. After the CNIL's answer, on 30 March 2021 Google delivered to the CNIL the necessary information showing their adjustments for compliance.
Full text 3 findings
Machine translation of the decision, via GDPRhub — not the official text. Read the original
Deliberation of restricted committee n ° SAN-2021-004 of April 30, 2021 relating to the injunction pronounced against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED by deliberation n ° 2020-012 of December 7, 2020 The National Commission for Informatics and Freedoms, meeting in its restricted formation composed of Messrs Alexandre LINDEN, President, and Philippe-Pierre CABOURDIN, Vice-President, and Ladies Anne DEBET and Christine MAUGÜE, members; Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 relating to the protection of personal data and the free movement of such data; Considering the law n ° 78-17 of January 6, 1978 modified relating to data processing, files and freedoms, in particular its articles 20 and following; Having regard to decree no 2019-536 of 29 May 2019 taken for the application of the law No. 78-17 of 6 January 1978 as amended relating to data processing, files and freedoms; Having regard to deliberation no 2013-175 of 4 July 2013 adopting the internal regulations of the National Commission for Informatics and Freedoms; Having regard to deliberation no 2020-012 of December 7, 2020 pronouncing a sanction against the companies GOOGLE LLC and GOOGLE IRELAND LIMITED; Considering the elements transmitted by the company GOOGLE IRELAND LIMITED on December 18, 2020 and March 30, 2021; Having regard to the other documents in the file; After deliberation, adopted the following decision: I. Facts and procedure Deliberation No. 2020-012 of December 7, 2020 ordered the companies GOOGLE LLC and GOOGLE IRELAND LIMITED to: bring the processing into line with the obligations resulting from Article 82 of the Data Protection Act and, in particular, to inform the persons concerned in advance and in a clear and complete manner, for example on the information banner on the home page of the google.fr site: - the purposes of all cookies subject to consent, - the means at their disposal to refuse them.
This injunction was accompanied by a fine of 100,000 euros per day of delay at the end of a period of three months following the notification of the deliberation, the supporting documents of the compliance having to be sent to the restricted formation in this case. time limit. On December 18, 2020, the company GOOGLE IRELAND LIMITED sent a letter to the CNIL in which it presented the changes it planned to deploy on the google.fr website by the end of February 2021 and to which the services of the CNIL responded on February 17, 2021. On March 30, 2021, within the time limit set by the deliberation, the company GOOGLE IRELAND LIMITED sent the restricted formation elements in order to justify its compliance. II.Reasons for the decision The restricted committee notes that it emerges from the elements provided in the response letter of March 30, 2021 that people visiting the google.fr site are now clearly and completely informed of all the purposes of cookies subject to consent. and the means available to them to refuse them, through the information banner displayed on their arrival on the site.
Consequently, the restricted committee considers that the companies GOOGLE LLC and GOOGLE IRELAND LIMITED have satisfied the injunction within the allotted time. This decision will be made public as was deliberation no 2020-012 of December 7, 2020. FOR THESE REASONS The restricted formation of the CNIL, after having deliberated, decides: - that there is no need for on-call liquidation; - make public, on the CNIL website and on the Légifrance website, its deliberation, which will no longer identify the companies by name as of December 11, 2022. Le président Alexandre LINDEN