Google and Shein pay up: French data watchdog hands out €486M in fines
Last year, the Commission Nationale de l’Informatique et des Libertés (CNIL), France’s data protection authority, imposed 83 sanctions on companies for violating Europe’s privacy laws, accumulating €486,839,500.
Image by Cybernews.
Last year, the Commission Nationale de l’Informatique et des Libertés (CNIL), France’s data protection authority, imposed 83 sanctions on companies for violating Europe’s privacy laws, accumulating €486,839,500.
These sanctions include 78 fines for violating Europe’s General Data Protection Regulation (GDPR). The majority of the fine was imposed on two companies: Google and Shein.
Google was fined €325 million for displaying unsolicited advertisements in Gmail inboxes that appeared to be genuine emails, as well as for failing to obtain informed consent before placing tracking cookies.
Chinese e-commerce platform Shein didn't respect users’ choices, neglected to adequately inform users, and installed tracking cookies without consent. For these reasons, the CNIL imposed a fine of €150 million on Shein.
“These decisions emphasize the impact of these practices for internet users, whose data is sometimes processed without their knowledge, and the fact that the sanctioned actors could not ignore the applicable rules, the CNIL having communicated widely on them for several years,” the CNIL said in a statement.
On top of the 78 fines, the French privacy and data protection authority imposed three payment obligation decisions for non-compliance with an order issued by the regulator. A total of 16 organizations were sanctioned for non-compliance with Europe’s privacy rules regarding video surveillance of employees.
In addition, the CNIL issued 143 formal notices to organizations for rectifying shortcomings in their GDPR compliance. For example, some websites installed tracking cookies on a user’s device without consent, or kept tracking users even when they withdrew their consent.
Lastly, the French privacy regulator ordered numerous companies to implement appropriate technical and organizational measures to guarantee an adequate level of data protection. Others were told to delete stored data after ending their contractual relationship with a data controller.
Fourteen organizations were sanctioned for not responding to requests from France’s privacy and data protection supervisor.
Unlock more exclusive Cybernews content on YouTube.