France's data protection authority announced on Monday that it was giving a record fine of 50 million euros to Google for failing to clearly notify users of its personal data usage policy.
CNIL is the first European regulatory body to impose sanctions on the global internet platform based on the new European data protection regulations (RGPD), which came into force on May 25, 2018.
The new European regulation estimates sanctions of up to 4% of the total annual global business volume of companies that have not fulfilled the obligation to protect European citizens' personal data, especially for advertising purposes.
CNIL received this sanction after receiving collective complaints from two associations defending the rights of Internet users in May last year, shortly after the enactment of European directives.
One is presented in the name of around 10,000 signatories by the French association Quadrature du Net, while the others are presented by None Of Your Business, created by Austrian data protection activist Max Schrems.
For his research, the French agency followed the steps that must be followed by new users of Android smartphones (operating systems for Google smartphones) to create Google accounts and use their devices.
"We do not deny that Google reported" to its users about the use of their personal data, said Mathias Moulin, CNIL director of rights protection and sanctions, told AFP.
"But the information is not easily accessed and disseminated in various documents," he said. "Sometimes it takes up to five clicks to access information," he added, so he concluded that Google did not propose "clear and understandable" information.
"People expect us to have a high standard of transparency and control, and we are very committed to meeting those expectations and the terms of the GDPR agreement," a Google spokesman said in a statement.
"We are studying the decision to determine our next move."
If Google decides to appeal this decision, Google must do so before the State Council, the highest administrative jurisdiction of the French State.
Fines are simple if you take into account Google's financial strength. Turnover of its parent company Alphabet grew 23% in 2017, to 110,900 million dollars, and recorded a net profit of 12,700 million dollars.
However, this is a good record in Europe for such cases. The amount is explained by the tentative nature of this case. As a result, to personalize ads, Google can cut user data from multiple platforms, such as YouTube, Google Home, Google Maps, or Playstore.
These practices have the potential to "reveal all segments" of their users' lives, "because they are based on a large volume of data, a variety of services, and the possibilities are almost unlimited for crossing data," CNIL said in a statement.
This is not the first time Google has had a conflict with the regulatory body regarding privacy. In 2012, the United States Federal Trade Commission (FTC) imposed a fine of 22.5 million dollars.