50M euros seems far too little to me. It's a major violation against a fundamental regulation in their core product and compared to their revenue, 50M is nothing. A magnitude more will probably get google thinking, but I doubt this will.
The EC's three antitrust cases against Google don't end with the billions of dollars in fines they have to pay. Google would gladly pay them if it meant they could continue their anti-competitive practices, it would just be a cost of doing business. But that's not the point of them.
I don't get how google can violate somthing like this and the only results is the enforecement of existing law and some fine? Or I am not getting something?
Use it once, and you won't have to use it again. I don't know the usual english translation of a quote attributed to Mao: punish one, teach one hundred.
Handing out fines that actually hurt will not only teach those that receive it but also everybody else. Making knuddels.de pay €20k for leaking the data (including clear text passwords) of millions of users just says "do as you please, here's a symbolic fine, we don't mind".
It does remind me off Google vs SEO-Black-Hat-Spammers. They get caught, the get a manual penalty, they remove the worst, say they're sorry, the penalty gets lifted, they continue on.
The job of European data protection agencies isn't to be punitive, but to ensure compliance.
If the issue was tiny, an honest mistake that was promptly fixed when it was brought to the offender's attention, and they show that they implement safeguards so that something like that won't happen again, there may be no fine at all.
Compared to this, EUR 50M is rather heavy handed, but given that Google has approximately $infinity at their disposal, no value would "ensure compliance".
What this does is ensure that the topic will be discussed by the board of directors (50M is probably beyond the discretionary spending budget of the not-quite-top level manager who handled this) with the outlook that there may be more fines like that.
OTOH it's still far from that "4% of global revenue" figure, so it gives room for escalation. Hopefully it's also small enough that it won't be disfigured too much into "the evil EU is being protectionist again!" US press cycle that comes up every time a US company is fined by some EU body.
Wouldn't larger fines ensure compliance though?
Will you make those changes?
Is it, though? Isn't the punishment supposed to fit the crime?
I think if corporations will continue to do what they want with impunity paying slap on the wrist fines for major illegalities, and passing laws in their favor through lobbying, people will eventually get fed up like they have in France, or worse. Then, more countries' populations will start demanding from their governments to impose the death penalty for corporations (at least in that government's jurisdiction) and mandatory arrests of top executives for serious corporate crimes and harm against consumers.
If the trend continues, I think it's only a matter of time until these demands become reality.
One thought: if Google had just served non-personalized ads (or personalized ads with much greater restrictions) to all of France, how much money would they have lost due to the ads being lower quality? With some very rough estimates, I'd guess $250 million in revenue resulting in $100 million in profit. ($1 billion revenue from France, $500 million from ads, ads are 2x more effective when personalized, 40% of revenue is profit). All very rough estimates/analysis, but it definitely seems like a significant slice (half the profit) of this part of Google's operations, and likely there's at least someone at Google who's thinking about this specific revenue source who just got a wake-up call. Given the roughness of the estimates, seems possibly at a point where it would have been better for Google to just give up on ad personalization (at least in France) altogether.
Another thought experiment: surely at some point (e.g. fining 100% or more of global revenue), Google will just stop operations in France (or Europe), which is probably not what anyone wants. What is that tipping point? If every country (or city) uses the "significant percentage of global revenue" approach, it's more likely to collectively become unreasonable. That's at least the extreme-case downside to giving a fine that's too big (especially proportional to the unfairly-gained profit in the jurisdiction giving out the fine).
No they won't.
The market is too large, and they are perfectly aware that they have competitors that manage to keep their businesses both legal and profitable.
Compared to the average US income, $50M is 15$.
It can be argued and should because the arguments laid out in this discussion set precedence that acts as a more concrete requirement that sits on top of GDPR. Basically imo this could be a very interesting set of arguments that mean changes to a huge amount of websites.
Isn't it just common sense based on everything in GDPR? I find it hard to believe that someone familiar with GDPR and without incentives to the contrary could legitly come away thinking the legislation intended to allow defaults to be anti-user-privacy.
> Moreover, the violations are continuous breaches of the Regulation as they are still observed to date. It is not a one-off, time-limited, infringement.
It's a warning notice, you see. Formal notice to Google, to fix this, or face real consequences.
One doesn't want to come down too heavy handed on these things. It will backfire. This light penalty and explicit notice that it requires immediate action to address, is a good move.
This is also the first offense and (one of) the first major fines to be handed out over GDPR, so it's not totally unsurprising that they might fire a warning shot to everyone that they can and will be cracking down, it wasn't an empty threat.
I wonder if this will lead to a situation like cigarette taxes in U.S. states where the "punitive" taxes wind up being a huge source of revenue that the states can't live without.
Fines aren't a one-off and everything is forgotten. If they don't establish compliance, they can be fined again continually, with increasing amounts.
It will depend on if the enforcement agencies follow through.
I don't see how; the GDPR allows member states to fine up to 4% of worldwide revenue. If just five states fine that amount, that's 20% of revenue. Even for Google, that's practically all of their profit, and way more than what they make in the EU. And there are complaints filed with seven regulatory agencies already.