Google Must Post Notice of CNIL Fine Over Single Privacy Policy During Appeal

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Rick Mitchell

Feb. 7 --France's highest administrative appeals court (Conseil d'État) Feb. 7 refused Google Inc.’s request to suspend an order by the French data protection authority (CNIL) requiring the company to post online a notice of CNIL's sanctions over Google's unified privacy policy (In re Google Inc., CE, No. 374595, 2/7/14).

CNIL's enforcement committee ruled Jan. 8 that the policy, which unifies data privacy conditions for some 60 Google services, violates France's 1978 data protection law, and it fined Google a record 150,000 euros ($203,888) (13 PVLR 99, 1/13/14).

CNIL also ordered Google to publish notice of the decision on the home page within eight days of receiving the enforcement ruling.

Appeal Continues

Google Jan. 13 appealed to the Conseil d'État (13 PVLR 133, 1/20/14). It then asked the court to suspend the posting sanction pending the outcome of the underlying appeal.

Google failed to prove that publishing the notice before a final ruling on its appeal of the sanction would damage its reputation in France, the court said.

In a Feb. 7 statement, CNIL said Google now has 48 hours to publish the notice.

A Google spokesman told Bloomberg BNA Feb. 7, “We've engaged fully with the CNIL throughout this process to explain our privacy policy and how it allows us to create simpler, more effective services. We will comply with the order to post the notice, but we'll also continue with our appeal before the Conseil d'État.”

EU Actions

CNIL, and other European Union data protection authorities, have repeatedly warned Google about the unified policy that Google launched in March 2012 to track user information across its e-mail, social networking, YouTube, search engine and other services, as part of a plan to integrate its 60 privacy policies into one (11 PVLR 426, 3/5/12).

On Dec. 19, 2013, Spain's DPA levied a separate $1.2 million enforcement fine against Google over its unified privacy policy (12 PVLR 2139, 12/23/13).

In November 2013 the Netherlands DPA ruled that Google's policy violates its data protection law (12 PVLR 2057, 12/9/13) but as of Feb. 7 hasn't levied a fine.

The company also faces actions in Germany, Italy and the U.K., as part of a joint EU enforcement action on Google's privacy policy (12 PVLR 612, 4/8/13).

To contact the reporter on this story: Rick Mitchell in Paris at

To contact the editor responsible for this story: Donald G. Aplin at

The court's opinion is available, in French, at

Request Bloomberg Law Privacy and Data Security