7 ms·

50M euros seems far too little to me. It's a major violation against a fundamental regulation in their core product and compared to their revenue, 50M is nothin

50M euros seems far too little to me. It's a major violation against a fundamental regulation in their core product and compared to their revenue, 50M is nothing. A magnitude more will probably get google thinking, but I doubt this will.

zaldun 8y ago
There are complaints like this in almost every European countries. If it's 50M fine in France, 50 more in Germany, 50 in The Netherlands and so on, it should start to be a huge amount!
- eeZah7Ux 8y ago
  To fine the company for merely 5% of their $110 bln revenue it would take 110 countries. Compared to the average US income, $50M is 15$.
  - olivierduval 8y ago
    In case of repeated and obvious offense (not the case of Google for now), the fine may grow up until 4% of the annual revenue... For each case !
  - chillacy 8y ago
    Is that 100 billion from all countries? If fines from EU exceeds profits from EU then that division would be bust, it’s more like 25 billion.
  - eeZah7Ux 8y ago
    So many downvotes. Never criticize our corporate overlords.
ahje 8y ago
Google will now be expected to do it all over, and follow the rules. If they fail, the fine will most likely be much higher.
onetimemanytime 8y ago
I think this is just for France and for this case. If they continue, they'll be new fines. Also other EU countries, I think, can jump in. Changing behavior is what hurts them, and apparently here no need for 5 year investigations. Matter of months and the verdict is in.
Despegar 8y ago
As always with these cynical comments about fines, it misunderstands the nature of them. Google or any other company does not get to just continue their practices as usual, the fine is purely "punishment" for the bad behavior in the past. The real teeth is in the changes they will be forced to make. The EC's three antitrust cases against Google don't end with the billions of dollars in fines they have to pay. Google would gladly pay them if it meant they could continue their anti-competitive practices, it would just be a cost of doing business. But that's not the point of them.
- LeanderK 8y ago
  but wouldn't a fine that's actually sizable send a different signal? I don't get how google can violate somthing like this and the only results is the enforecement of existing law and some fine? Or I am not getting something?
  - Despegar 8y ago
    GDPR would have allowed fines of up to 4% of Google's global turnover. That's a bazooka you don't use for every infraction. If Google is found to be a repeat offender or fails to comply, that's probably when regulators will use that particular tool in their toolbox.
    - luckylion 8y ago
      > That's a bazooka you don't use for every infraction. Use it once, and you won't have to use it again. I don't know the usual english translation of a quote attributed to Mao: punish one, teach one hundred. Handing out fines that actually hurt will not only teach those that receive it but also everybody else. Making knuddels.de pay €20k for leaking the data (including clear text passwords) of millions of users just says "do as you please, here's a symbolic fine, we don't mind".
      - SpicyLemonZest 8y ago
        I mean, there's a reason that quote is attributed to Mao. When regulators fire off ruinous fines as a first resort, the lesson companies learn is not that everything will be okay if they follow the rules.
CorvusCrypto 8y ago
Perhaps. Though with GDPR the framework is intentionally vague on a lot of things. You often hear about limits and design requirements and such, well those don't exist. They are just legal "best guesses" with the frameworks inherent goal as a guide. Nobody knows whether default configs are disallowed as long as opt-in is positive action. The current best guesses for that vary and all that's known in GDPR in that regard is that there must be positive user opt-in with a good faith effort of informing the user. In this sense google likely thought they were satisfying this requirement. It can be argued and should because the arguments laid out in this discussion set precedence that acts as a more concrete requirement that sits on top of GDPR. Basically imo this could be a very interesting set of arguments that mean changes to a huge amount of websites.
- mehrdadn 8y ago
  > Nobody knows whether default configs are disallowed as long as opt-in is positive action. Isn't it just common sense based on everything in GDPR? I find it hard to believe that someone familiar with GDPR and without incentives to the contrary could legitly come away thinking the legislation intended to allow defaults to be anti-user-privacy.
  - CorvusCrypto 8y ago
    Why would it be common sense? Literally nothing is written about design details. At a certain point burden will fall on the user and no it's not common sense where that point lies. Legal arguments such as this case are what concretely define expectations. I get the data protection part and it's easy to just say "anyone that does X is against data protection", but implementing stuff to satisfy GDPR is a mess of grey areas. It's just as likely a company sets defaults to streamline the UI experience for a user as is the case they did it to maliciously trick users (Yeah yeah google is evil etc. Etc. But remember these decisions affect all companies). This is not to mention the fact that many companies dont even offer customized settings and simply have only blanket opt-in checkboxes.
PaulHoule 8y ago
The way the GDPR is written it seems that big co's will be able to pay their way out of noncompliance, the percentage of revenues that they charge in fees is a lot but it won't erase their margin. I wonder if this will lead to a situation like cigarette taxes in U.S. states where the "punitive" taxes wind up being a huge source of revenue that the states can't live without.
- the_duke 8y ago
  Not really. Fines aren't a one-off and everything is forgotten. If they don't establish compliance, they can be fined again continually, with increasing amounts. It will depend on if the enforcement agencies follow through.
- icebraining 8y ago
  > the percentage of revenues that they charge in fees is a lot but it won't erase their margin. I don't see how; the GDPR allows member states to fine up to 4% of worldwide revenue. If just five states fine that amount, that's 20% of revenue. Even for Google, that's practically all of their profit, and way more than what they make in the EU. And there are complaints filed with seven regulatory agencies already.
chrismeller 8y ago
Similarly to raising taxes you also have to keep in mind that governments walk a tight rope: too little and it doesn't accomplish what you wanted but too much and you could then be dealing with a lot of unemployed people. Neither is good, so you have to be careful. This is also the first offense and (one of) the first major fines to be handed out over GDPR, so it's not totally unsurprising that they might fire a warning shot to everyone that they can and will be cracking down, it wasn't an empty threat.
trystero 8y ago
Still more than a 100 times the usual amount for the CNIL fines. https://www.cnil.fr/en/tag/sanctions https://www.cnil.fr/en/tag/sanctions
- TheRealPomax 8y ago
  It could be a million times higher, but if it's an amount the company in question turns over in less than an hour, it still meaningless. As a fine, it's almost insignificant, but as judicial signal it _is_ important, because it's the first official warning, and ignoring it means the next punitive measure will be orders of magnitude higher.
- laurentl 8y ago
  It’s also the first fine to be handed out after the GDPR came into effect (the other fines on the page are for infractions discovered before May 2017). Which is one of the reasons the GDPR was passed: previous laws had much less teeth when it came to fines.
  - zaarn 8y ago
    Not the first; a german chat app was hit by a minor fine because they stored passwords in cleartext in 2018.
    - laurentl 8y ago
      Sorry, I meant "the first by CNIL" (or even more specifically, the first in the list of previous fines that was a couple of posts above)
agumonkey 8y ago
Felt like a ridicule amount, but also a sum that Google will not think a lot before paying which may serve as an admission/precedent for future laws.
alangpierce 8y ago
Certainly, taking a nontrivial percentage of global revenue will force Google's attention, but I'm not convinced that's the best way to think about it. One thought: if Google had just served non-personalized ads (or personalized ads with much greater restrictions) to all of France, how much money would they have lost due to the ads being lower quality? With some very rough estimates, I'd guess $250 million in revenue resulting in $100 million in profit. ($1 billion revenue from France, $500 million from ads, ads are 2x more effective when personalized, 40% of revenue is profit). All very rough estimates/analysis, but it definitely seems like a significant slice (half the profit) of this part of Google's operations, and likely there's at least someone at Google who's thinking about this specific revenue source who just got a wake-up call. Given the roughness of the estimates, seems possibly at a point where it would have been better for Google to just give up on ad personalization (at least in France) altogether. Another thought experiment: surely at some point (e.g. fining 100% or more of global revenue), Google will just stop operations in France (or Europe), which is probably not what anyone wants. What is that tipping point? If every country (or city) uses the "significant percentage of global revenue" approach, it's more likely to collectively become unreasonable. That's at least the extreme-case downside to giving a fine that's too big (especially proportional to the unfairly-gained profit in the jurisdiction giving out the fine).
- ahje 8y ago
  > Google will just stop operations in France (or Europe) No they won't. The market is too large, and they are perfectly aware that they have competitors that manage to keep their businesses both legal and profitable.
  - alangpierce 8y ago
    I guess it's a complex decision, but I feel like if I was running a worldwide business and a single country decided to impose a $100 billion fine (the scenario I was describing), I'd want nothing to do with that country. That's much, much more than the market opportunity that Google has in France. Probably I'd want to avoid operating at all in countries that have a chance of imposing that scale of fine.
bryanrasmussen 8y ago
50M euro here, 50M euro there pretty soon you're talking real money.
jiveturkey 8y ago
It's a fair penalty. > Moreover, the violations are continuous breaches of the Regulation as they are still observed to date. It is not a one-off, time-limited, infringement. It's a warning notice, you see. Formal notice to Google, to fix this, or face real consequences. One doesn't want to come down too heavy handed on these things. It will backfire. This light penalty and explicit notice that it requires immediate action to address, is a good move.

zaldun 8y ago

There are complaints like this in almost every European countries. If it's 50M fine in France, 50 more in Germany, 50 in The Netherlands and so on, it should start to be a huge amount!

eeZah7Ux 8y ago
To fine the company for merely 5% of their $110 bln revenue it would take 110 countries. Compared to the average US income, $50M is 15$.
- olivierduval 8y ago
  In case of repeated and obvious offense (not the case of Google for now), the fine may grow up until 4% of the annual revenue... For each case !
- chillacy 8y ago
  Is that 100 billion from all countries? If fines from EU exceeds profits from EU then that division would be bust, it’s more like 25 billion.
- eeZah7Ux 8y ago
  So many downvotes. Never criticize our corporate overlords.

ahje 8y ago

Google will now be expected to do it all over, and follow the rules. If they fail, the fine will most likely be much higher.

onetimemanytime 8y ago

I think this is just for France and for this case. If they continue, they'll be new fines. Also other EU countries, I think, can jump in. Changing behavior is what hurts them, and apparently here no need for 5 year investigations. Matter of months and the verdict is in.

Despegar 8y ago

As always with these cynical comments about fines, it misunderstands the nature of them. Google or any other company does not get to just continue their practices as usual, the fine is purely "punishment" for the bad behavior in the past. The real teeth is in the changes they will be forced to make. The EC's three antitrust cases against Google don't end with the billions of dollars in fines they have to pay. Google would gladly pay them if it meant they could continue their anti-competitive practices, it would just be a cost of doing business. But that's not the point of them.

LeanderK 8y ago
but wouldn't a fine that's actually sizable send a different signal? I don't get how google can violate somthing like this and the only results is the enforecement of existing law and some fine? Or I am not getting something?
- Despegar 8y ago
  GDPR would have allowed fines of up to 4% of Google's global turnover. That's a bazooka you don't use for every infraction. If Google is found to be a repeat offender or fails to comply, that's probably when regulators will use that particular tool in their toolbox.
  - luckylion 8y ago
    > That's a bazooka you don't use for every infraction. Use it once, and you won't have to use it again. I don't know the usual english translation of a quote attributed to Mao: punish one, teach one hundred. Handing out fines that actually hurt will not only teach those that receive it but also everybody else. Making knuddels.de pay €20k for leaking the data (including clear text passwords) of millions of users just says "do as you please, here's a symbolic fine, we don't mind".
    - SpicyLemonZest 8y ago
      I mean, there's a reason that quote is attributed to Mao. When regulators fire off ruinous fines as a first resort, the lesson companies learn is not that everything will be okay if they follow the rules.

CorvusCrypto 8y ago

Perhaps. Though with GDPR the framework is intentionally vague on a lot of things. You often hear about limits and design requirements and such, well those don't exist. They are just legal "best guesses" with the frameworks inherent goal as a guide. Nobody knows whether default configs are disallowed as long as opt-in is positive action. The current best guesses for that vary and all that's known in GDPR in that regard is that there must be positive user opt-in with a good faith effort of informing the user. In this sense google likely thought they were satisfying this requirement. It can be argued and should because the arguments laid out in this discussion set precedence that acts as a more concrete requirement that sits on top of GDPR. Basically imo this could be a very interesting set of arguments that mean changes to a huge amount of websites.

mehrdadn 8y ago
> Nobody knows whether default configs are disallowed as long as opt-in is positive action. Isn't it just common sense based on everything in GDPR? I find it hard to believe that someone familiar with GDPR and without incentives to the contrary could legitly come away thinking the legislation intended to allow defaults to be anti-user-privacy.
- CorvusCrypto 8y ago
  Why would it be common sense? Literally nothing is written about design details. At a certain point burden will fall on the user and no it's not common sense where that point lies. Legal arguments such as this case are what concretely define expectations. I get the data protection part and it's easy to just say "anyone that does X is against data protection", but implementing stuff to satisfy GDPR is a mess of grey areas. It's just as likely a company sets defaults to streamline the UI experience for a user as is the case they did it to maliciously trick users (Yeah yeah google is evil etc. Etc. But remember these decisions affect all companies). This is not to mention the fact that many companies dont even offer customized settings and simply have only blanket opt-in checkboxes.

PaulHoule 8y ago

The way the GDPR is written it seems that big co's will be able to pay their way out of noncompliance, the percentage of revenues that they charge in fees is a lot but it won't erase their margin. I wonder if this will lead to a situation like cigarette taxes in U.S. states where the "punitive" taxes wind up being a huge source of revenue that the states can't live without.

the_duke 8y ago
Not really. Fines aren't a one-off and everything is forgotten. If they don't establish compliance, they can be fined again continually, with increasing amounts. It will depend on if the enforcement agencies follow through.
icebraining 8y ago
> the percentage of revenues that they charge in fees is a lot but it won't erase their margin. I don't see how; the GDPR allows member states to fine up to 4% of worldwide revenue. If just five states fine that amount, that's 20% of revenue. Even for Google, that's practically all of their profit, and way more than what they make in the EU. And there are complaints filed with seven regulatory agencies already.

chrismeller 8y ago

Similarly to raising taxes you also have to keep in mind that governments walk a tight rope: too little and it doesn't accomplish what you wanted but too much and you could then be dealing with a lot of unemployed people. Neither is good, so you have to be careful. This is also the first offense and (one of) the first major fines to be handed out over GDPR, so it's not totally unsurprising that they might fire a warning shot to everyone that they can and will be cracking down, it wasn't an empty threat.

trystero 8y ago

Still more than a 100 times the usual amount for the CNIL fines. https://www.cnil.fr/en/tag/sanctions https://www.cnil.fr/en/tag/sanctions

TheRealPomax 8y ago
It could be a million times higher, but if it's an amount the company in question turns over in less than an hour, it still meaningless. As a fine, it's almost insignificant, but as judicial signal it _is_ important, because it's the first official warning, and ignoring it means the next punitive measure will be orders of magnitude higher.
laurentl 8y ago
It’s also the first fine to be handed out after the GDPR came into effect (the other fines on the page are for infractions discovered before May 2017). Which is one of the reasons the GDPR was passed: previous laws had much less teeth when it came to fines.
- zaarn 8y ago
  Not the first; a german chat app was hit by a minor fine because they stored passwords in cleartext in 2018.
  - laurentl 8y ago
    Sorry, I meant "the first by CNIL" (or even more specifically, the first in the list of previous fines that was a couple of posts above)

agumonkey 8y ago

Felt like a ridicule amount, but also a sum that Google will not think a lot before paying which may serve as an admission/precedent for future laws.

alangpierce 8y ago

Certainly, taking a nontrivial percentage of global revenue will force Google's attention, but I'm not convinced that's the best way to think about it. One thought: if Google had just served non-personalized ads (or personalized ads with much greater restrictions) to all of France, how much money would they have lost due to the ads being lower quality? With some very rough estimates, I'd guess $250 million in revenue resulting in $100 million in profit. ($1 billion revenue from France, $500 million from ads, ads are 2x more effective when personalized, 40% of revenue is profit). All very rough estimates/analysis, but it definitely seems like a significant slice (half the profit) of this part of Google's operations, and likely there's at least someone at Google who's thinking about this specific revenue source who just got a wake-up call. Given the roughness of the estimates, seems possibly at a point where it would have been better for Google to just give up on ad personalization (at least in France) altogether. Another thought experiment: surely at some point (e.g. fining 100% or more of global revenue), Google will just stop operations in France (or Europe), which is probably not what anyone wants. What is that tipping point? If every country (or city) uses the "significant percentage of global revenue" approach, it's more likely to collectively become unreasonable. That's at least the extreme-case downside to giving a fine that's too big (especially proportional to the unfairly-gained profit in the jurisdiction giving out the fine).

ahje 8y ago
> Google will just stop operations in France (or Europe) No they won't. The market is too large, and they are perfectly aware that they have competitors that manage to keep their businesses both legal and profitable.
- alangpierce 8y ago
  I guess it's a complex decision, but I feel like if I was running a worldwide business and a single country decided to impose a $100 billion fine (the scenario I was describing), I'd want nothing to do with that country. That's much, much more than the market opportunity that Google has in France. Probably I'd want to avoid operating at all in countries that have a chance of imposing that scale of fine.

bryanrasmussen 8y ago

50M euro here, 50M euro there pretty soon you're talking real money.

jiveturkey 8y ago

It's a fair penalty. > Moreover, the violations are continuous breaches of the Regulation as they are still observed to date. It is not a one-off, time-limited, infringement. It's a warning notice, you see. Formal notice to Google, to fix this, or face real consequences. One doesn't want to come down too heavy handed on these things. It will backfire. This light penalty and explicit notice that it requires immediate action to address, is a good move.