It is also a violation of the GDPR (Art. 25) if Google cannot prove they implemented the "appropriate technical and organisational measures" to protect personal

It is also a violation of the GDPR (Art. 25) if Google cannot prove they implemented the "appropriate technical and organisational measures" to protect personal information, both at the time of designing that system, and at the time of actually exploiting that system with live traffic.