France ∙ Lessons from the First Post-GDPR Fines of the CNIL against Google LLC

Tambou, Olivia

doi:10.21552/edpl/2019/1/13

Cited by 5 publications

(7 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In case of serious violation of GDPR, 4% of the company's global annual sales or e20 million, whichever is higher, is charged, and in the case of general violations, 2% or e10 million, whichever is higher. For instance, "Google" was fined by the France National Data Protection Commission in January 2019 for not properly obtaining consent from data subjects [53]. The decision was once again upheld at the French supreme administrative court following the appeal by Google LLC (Limited Liability Company) [54].…”

Section: Risk Evaluationmentioning

confidence: 99%

Data De-identification Framework

Oh¹,

Lee²

2023

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

As technology develops, the amount of information being used has increased a lot. Every company learns big data to provide customized services with its customers. Accordingly, collecting and analyzing data of the data subject has become one of the core competencies of the companies. However, when collecting and using it, the authority of the data subject may be violated. The data often identifies its subject by itself, and even if it is not a personal information that infringes on an individual's authority, the moment it is connected, it becomes important and sensitive personal information that we have never thought of. Therefore, recent privacy regulations such as GDPR (General Data Protection Regulation) are changing to guarantee more rights of the data subjects. To use data effectively without infringing on the rights of the data subject, the concept of de-identification has been created. Researchers and companies can make personal information less identifiable through appropriate de-identification/pseudonymization and use the data for the purpose of statistical research. De-identification/pseudonymization techniques have been studied a lot, but it is difficult for companies and researchers to know how to de-identify/pseudonymize data. It is difficult to clearly understand how and to what extent each organization should take deidentification measures. Currently, each organization does not systematically analyze and conduct the situation but only takes minimal action while looking at the guidelines distributed by each country. We solved this problem from the perspective of risk management. Several steps are required to secure the dataset starting from pre-processing to releasing the dataset. We can analyze the dataset, analyze the risk, evaluate the risk, and treat the risk appropriately. The outcomes of each step can then be used to take appropriate action on the dataset to eliminate or reduce its risk. Then, we can release the dataset under its own purpose. These series of processes were recon-

show abstract

Section: Risk Evaluationmentioning

confidence: 99%

Data De-identification Framework

Oh¹,

Lee²

2023

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

show abstract

“…Tambou [15] states that the fine imposed by the French Data Protection Authority on January 21, 2019 was not the first. However, the significant amount of 50 million euros demonstrated the effect of the GDPR and can be representing a paradigm shift.…”

Section: The General Data Protection Regulation (Gdpr)mentioning

confidence: 99%

“…The sanctions for violating the GDPR can be substantial, and some have already been enforced. These include the epoch-making examples of large fines levied against Google in France [15] and against a German real estate company [16]. However, any company that collects customer data belonging to the European Union (EU) or the European (EEA) must comply with the GDPR regardless of size (small or large), type (profitable or non-profit) or nationality (European or non-European).…”

Section: Introductionmentioning

confidence: 99%

An analysis of violations and sanctions following the GDPR

Presthus

Sønslien

2021

IJISPM

View full text Add to dashboard Cite

This paper investigates the violations and sanctions that have occurred following the implementation of the General Data Protection Regulation (GDPR). The GDPR came into effect in May 2018 with the aim of strengthening the information privacy of European Union/European Economic Area citizens. Based on existing taxonomies of (i) potential consequences of violating the GDPR (including surveillance, discrimination), (ii) an analysis of 277 sanctions, and (iii) interviews with experts, we offer a mapping of the violations and sanctions almost two years after the regulation was implemented. The most typical complaints were, in descending order: unlawful processing and disclosure of personal information, failure to act on and secure subject rights and personal information, and insufficient cooperation with supervising authorities. Our analysis also indicates an increasing number of fines over time. Regarding size, the fines range from 50,000,000 euros to (symbolic?) 90 euros. While research on GDPR violations and sanctions is somewhat scarce, our study mainly confirms existing findings: that the GDPR is complex and challenging. However, our study provides insight on some of the challenges. Our contribution is mainly practical and aimed at managers in any organization whose goal is to protect information privacy and to learn from the mistakes made by other companies. We also welcome more research on the topic.

show abstract

“…16 The media holds significant role in furthering public debate in a democratic society. In Castells v. Spain, the ECtHR stated that it is incumbent on the media to impart information and ideas on political questions and on other matters of political interest 17 , without suffering under the criminal law restricting the right of the public to be informed. The value of media pluralism represents the guarantee for public debate, which involves disagreement and confrontation (Topidi, 2019: 5).…”

Section: Regulating the Freedom Of Expression And On-line/digital Pla...mentioning

confidence: 99%

“…16 Dink v. Turkey,17 Castells v. Spain, No.11798/85, 23 April 2012, para.43 18. Ahmet Yildirim v. Turkey, No.3111/10, 18 December 2012, para.54 19.…”

mentioning

confidence: 99%

Is freedom of expression in danger in the light of the CJEU decisions on the cases C-507-17 google v. CNIL and C-18/18 EVA Glawischnig- Piesczek v. Facebook?

Başar

2021

Aktual. probl. pravozn.

View full text Add to dashboard Cite

At first sight, these cases do not directly related to those fundamental rights as they are more about personal, material and territorial limits on the scope of right to be forgotten (Google v. CNIL) or an injunction (G-P v. Facebook). However they, especially the second judgement, will have serious effect on freedom of expression and access to information. In Google v. CNIL, the CJEU ruled that French national data protection authority's order demanding that Google remove certain offending search results worldwide was impermissible. On the other hand, in G-P v. Facebook, the Court held that Article 15 of the EU's e-commerce directive does not prohibit EU Member States from ordering extremely broad injunctions against platforms like Facebook to take down offending material (and therefore allows it). The court held that these injunctions can cover a wide array of material-not just Facebook posts but also reposts and "equivalent" posts-and apply worldwide.In this study, the limits to the freedom of expression and access to information shall be analysed under the case law of the ECtHR and CJEU with specific evaluation as the possible consequences of Google and Facebook judgements rendered by the CJEU.

show abstract

France ∙ Lessons from the First Post-GDPR Fines of the CNIL against Google LLC

Cited by 5 publications

References 0 publications

Data De-identification Framework

Data De-identification Framework

An analysis of violations and sanctions following the GDPR

Is freedom of expression in danger in the light of the CJEU decisions on the cases C-507-17 google v. CNIL and C-18/18 EVA Glawischnig- Piesczek v. Facebook?

Contact Info

Product

Resources

About