After almost two years of back and forth with Google, the French CNIL has, similarly to the Spanish Data Protection authority (€900,000 fine), sanctioned Google with a €150,000 fine, as Google refused to review its integrated platform and to modify its privacy policy as requested by the Working Party 29.
In addition to this fine, the CNIL has ordered Google to post a warning on Google's French home page within eight days after the CNIL's notification, and during two days reflecting this condemnation.
Google has decided to appeal the CNIL's condemnation in front of the French Council of State ("Conseil d'Etat"), France's highest administrative jurisdiction, in order to obtain the cancellation or reversal of the decision.
One could wonder why Google puts so much energy into trying to reverse a condemnation that is "bearable" from a financial point of view: there are at least two reasons for this.
First, the warning to be posted being the "real" condemnation – as it is deemed to be displayed to millions of Google users – Google has no other choice but to appeal the decision in order to avoid it. And as the appeal does not hinder the immediate enforceability of the sanction, Google had simultaneously introduced a petition for suspension before the Conseil d'Etat.
The hearing is scheduled to take place February 6, 2014.
Second, and more importantly, this condemnation could be the first step before criminal penalties this time: the French criminal code provides that failure to comply with the French Data Protection Act shall be punished per infringement with a fine of €300,000 and imprisonment of up to five years.
These sanctions can only be ordered if the CNIL has issued before an "administrative" sanction it has alone the power to take. This is what happened earlier this month.
Note that according to article 131-38 of the French Criminal Code, if a legal person is being convicted, the amount of the fine is multiplied by five, and in addition by two in case of recidivism.
Therefore, on that basis, Google could face a risk of being convicted to a fine of €1.5 million or even €3 million for recidivism, per infringement.
There lies a real financial threat since, after this first "administrative" fine has been ordered by the CNIL, a criminal case could now follow.
The legal proceedings against Google in France may only have commenced.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.