Advertising cookies: Record-high penalties from the CNIL against Google and Amazon.
10 December 2020
On December 7th, 2020, the CNIL (French Data Protection Authority) sanctioned the companies GOOGLE LLC and GOOGLE IRELAND LIMITED with a total fine of 100 million euros, highest sanction ever pronounced by the authority. On the same day, the CNIL also issued a 35 million euros sanction against AMAZON EUROPE CORE.
At issue: the placing of advertising cookies on the computers of users of the search engine google.fr and of the amazon.fr website, without prior consent or satisfactory information.
Non-compliance with the e-privacy directive: Interestingly enough the CNIL procedure was not based on the GDPR but on the “ePrivacy” directive, transposed in article 82 of the French Data Protection Act. Because of this legal basis, the CNIL was able to take the hand of the Irish and the Luxembourgish Data Protection Authorities, considering that the one-stop-shop mechanism provided for by the GDPR was not applicable in this case.
What’s next: The CNIL has given Google companies a 3-month deadline to comply with the French Data Protection Act, under penalty of €100,000 per day of default.
From the date of notification or publication of the decision, the sanctioned organizations have the possibility to file an appeal before French highest administrative court (the Conseil d’Etat) within two months. Yet, it is important to note that the CNIL decision is enforceable as soon as it is notified, and the appeal has no suspensive effect. As a result of the appeal, the Conseil d’Etat has the power not only to annul or confirm the decision of the CNIL, but also to modify it. This procedure may take a relatively long time, emergency recourses are also possible.
Under the emergency procedure, the référé-suspension allows to ask the Conseil d’Etat to temporarily suspend the execution of an administrative decision pending a verdict on the merits. In order for such summary proceedings to succeed, the decision must be the subject of a motion for annulment or reversal, the urgency justifies this procedure and there must be serious doubt as to its legality. Depending on the degree of urgency, the decision to suspend the execution of the decision may be taken within a period ranging from 48 hours to 1 month.
Another emergency procedure is the référé-liberté, which allows the judge in charge of the Conseil d’Etat to take all necessary measures to safeguard a fundamental freedom that the restricted formation of the CNIL would have seriously and obviously illegally infringed. To be able to engage such a summary proceedings, it is necessary not only to justify an emergency making necessary a fast intervention of the judge, but also to show that a fundamental freedom is in question and that the violation which is carried out is serious and obviously illegal. The judge in charge of the summary proceedings then pronounces within 48 hours.
As a reminder, Google had already appealed a CNIL decision last year, after being imposed a penalty of 50 million euros. However, it was unsuccessful as the Conseil d’Etat had validated the sentence a few months later.