<!-- wp:paragraph -->
<p>In what is today the biggest fine under the GDPR, the French Data Protection Authority CNIL investigated Google Android transparency in Data procession. The investigation was consecutive to two class actions filed on the 25th of May 2018. One by the Austrian NGO Non Of Your Business (NOYB), another by the French La Quadrature du Net (LQDN).</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>In its complaint, NOYB stated in particular that users of Android mobile devices are required to accept Google's privacy policy and general terms and conditions of service and that, failing such acceptance, they could not use their terminal.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The association LQDN complained that, regardless of the terminal used, Google does not have valid legal bases to implement the processing of personal data for purposes of behaviour analysis and advertising targeting.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>First  of all, the CNIL has shown high celerity to deal with the complaints.</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li>On 1st June 2018, the CNIL submitted the complaints to its European counterparts via the European information exchange system with a view to the designation of a possible lead authority in accordance with the provisions of Article 56 of the GDPR.</li><li>20 September 2018 : Decision to investigate the Android's data procession is taken; </li><li>on 21 September, an online test was carried out  to verify the compliance of any processing relating to the use of the operating system Android for mobile equipment, including the creation of a Google account.</li><li>24 and 25th September, the report was notified to GOOGLE LLC companies. and Google France SARL</li><li>28 September 28,  the two companies also received the aforementioned complaints by courier of the CNIL</li><li>2nd Octobre, Mr. François PELLEGRINI was appointed as rapporteur according to the article 47 French Data Protection law of January 6, 1978</li><li>22nd October, the reporter notified Google LLC and Google France a report detailing shortcomings relating to sections 6, 12 and 13 of the GDPR. The report suggested a fine of 50 million euros to be made public. </li><li>7 November 2018, Google requested a hearing from the rapporteur, </li><li>13 November the request was rejected .</li><li> On the same date, the company also made a request for closed doors and postponement of the meeting, </li><li>15 November the request was rejected.</li><li>22nd November, Google filed a written comments on the report. </li><li>7th December, the rapporteur replied to these observations.</li><li>11th December, Google, which had fifteen days from receipt of the rapporteur's to reply, requested to postpone the meeting and extend the deadline to produce new observations.  </li><li>13th December , the request was accepted to postpone for two weeks - until January 7 - the deadline for filing these observations and to postpone the meeting to January 15, 2019.</li><li>4th January, Google filed new observations in response to those of the rapporteur.</li><li>All observations were reiterated orally during the meeting of 15 January 2019.</li><li>21st January the decision was made public.</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>On the decision itself, Google argued the French CNIL should not be the competent Data Protection Authority.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Based on Article 55 (1) of the GDPR states: Each supervisory authority shall be competent to exercise the tasks and powers vested in it in accordance with this Regulation in the territory of the Member State to which it belongs.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Article 56 (1) of the GDPR provides: Without prejudice to Article 55, the supervisory authority of the principal place of business or of the sole place of business of the controller or processor shall have jurisdiction to act as lead supervisory authority for cross-border processing by that controller or processor, in accordance with the procedure laid down in Article 60.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Google argued that the CNIL could not be competent to conduct this procedure and that it should have transmitted the complaints received to the Irish Data Protection Commission (DPC) the lead authority to deal with these cross-border complaints in accordance with Art 60 GDPR. Google Ireland Limited being its main establishment in the EU for some of the its cross-border processing, including those objects of the complaints.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Therefore, initial discussions turned around the competent authority as defined by the main establishment of the company. Google arguing Ireland to be its main establishment, the CNIL responding the main Administrative establishment is not the criteria. Based on Article 4 (16) of the RGPD and Recital 36 GDPR, the main establishment to consider should be based on objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes and means of processing trough stable arrangements. The CNIL added that the determination should be analysed in concreto, according to objective criteria. The main establishment could therefore not necessarily correspond to the main designated administrative establishment.  The CNIL based its position on the WP article 29 guidance WP244 of 5th April 2017 "<em>the central administration is the place where the decisions are made on the purposes and means of processing.</em>"</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Deciding otherwise would result on forum shopping, says the CNIL. Google Ireland had no decisional power. Google Ireland Limited is not mentioned in the Company's Privacy Policy dated May 25, 2018 as the entity where the main decisions about the purposes and means of the processing are made. covered by the privacy policy presented to the user when creating his account, during the configuration of his mobile phone on Android. In fact Google had not either named any DPO in Ireland who would be in charge of the processing of personal data that it could implement in the European Union. It further notes that the Android operating system is developed solely by Google LLC.. Additionally, the company itself had indicated, by mail dated December 3, 2018 addressed to the DPC, that the transfer of responsibility of Google LLC. to Google Ireland Limited on certain processing of personal data concerning European citizens would be finalized on 31 January 2019. It later specified to update its confidentiality rules which will come into effect on 22 January 2019. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Google's argument that a reorganisation both operational and organizational was underway to make the company Google Ireland Limited the controller for certain processing of personal data concerning European nationals, was in my view a mistake only proving that at the time of the compliant Google Ireland had no decisional power.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>It also considers that the definition of principal place of business should be distinguished from that of controller and that if the</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Arguing that if the European legislator had intended that the concept of principal place of business should be interpreted as the place where decisions concerning 'would have expressly indicated simply ignored the text of the Recital 36.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>In the absence of a principal establishment allowing the identification of a lead authority, the one stop shop did not apply, and the CNIL was competent to initiate this procedure and to exercise all of its powers under Article 58 of the GDPR.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This is a very interesting analysis to determine the main establishment and the lead authority based on objective criteria and not a subjective decision favouring forum shopping. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>On the Procedure</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Google argued on the validity of the complaints.  The CNIL responded that the question of the admissibility of the complaints could not affect the legality of the proceedings, as it could self-refer itself based on the findings made by its services. The CNIL had therefore a mission to supervise the application of the regulation and to ensure compliance with it and that it has, for this purpose, the power to carry out investigations, in accordance with Arti 57 1. a) and h) of the RGPD. In fact, the two associations had been mandated to represent the complaints under article 80 of the RGPD.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The second argument claiming that the proceedings breached its right to a fair trial according to Art 6 of the Convention for the Protection of Human Rights and Fundamental Freedoms that the rapport to his observations were addressed in French, sounded rather difficult to succeed. The CNIL responded to that any notification of a penalty report had to be in French based on a legal obligation laid down in Article 111-1 of the Code of relations between the public and the administration which provides that use of the French language is prescribed in the exchanges between the public and the administration, in accordance with the provisions of the law n ° 94-665 of August 4, 1994 relating to the use of the French language. Google has an establishment on the French territory with several hundred employees. Google had in any event sufficient material and human resources enabling it to ensure a translation of the documents in English in sufficient time to become acquainted with it and to make observations within the deadline.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>In view of these elements, the Restricted Training considers that the company had in any event sufficient material and human resources enabling it to ensure a translation of the documents in English in sufficient time to become acquainted with it and to make observations in the the deadline fixed for it.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This point explains why it is important that the Organisations' representative speak the language of the DPA.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Also the refusal to extend the time limit he was opposed to produce his first observations and limited the time available to prepare his defence. It also considers that the adjournment of the meeting as well as the additional time it was finally granted to produce its second observations were still not sufficient.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>3.Over the scope of investigations</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Google argued first of all that the rapporteur has confused the Android operating system and the Google account when they are separate services that implement different treatment activities. Then argued that the scope of control chosen by the CNIL - namely the creation of a Google account when setting up a new device using the Android operating system - is limited in that it only represents a case figure affecting 7% of users. Finally, it indicated that the findings were made on an older version of the Android operating system.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The CNIL did not disputed the existence of separate services, respectively related to the Android operating system and the Google Account, implementing different processing activities.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>It observed, however, that the facts covered by the investigations corresponded to the scenario chosen to carry out the on-line check, namely the journey of a user and the documents to which he could have accessed during the initial configuration of his mobile equipment using the Android operating system. This path included the creation of an account. These facts therefore related to the treatments covered by the privacy policy presented to the user when creating an account during the setting up of their mobile phone on Android.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Then, adding that if it was true that the user actually had the choice to create an account and has the opportunity to use some of the services without having to create an account, however, when setting up an Android device, the ability to create a Google account or connect to an existing account naturally appeared at the beginning of the setting process, without specific action of the user.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>In any case, under Article 11.I.2 of the Data Protection Act, the CNIL has a broad discretion as to the scope of the controls it may undertake. A specific control scenario, such as that used in this case, may make it possible to make findings reflecting a more comprehensive privacy policy. The scope of the processing of personal data that is performed is therefore is irrelevant so is the version of the Android operating system since it appears from the documents provided by Google that the user's journey is similar in the newer version .</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>4.On breach of transparency and information obligations</strong><br></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Article 12 (1) GDPR provides: "<em>1.The controller shall take appropriate measures to provide any information referred to in </em><a href="http://www.privacy-regulation.eu/en/article-13-information-to-be-provided-where-personal-data-are-collected-from-the-data-subject-GDPR.htm"><em>Articles 13</em></a><em> and 14 and any communication under </em><a href="http://www.privacy-regulation.eu/en/article-15-right-of-access-by-the-data-subject-GDPR.htm"><em>Articles 15</em></a><em> to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means." </em></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Article 13 (1) provides that:  <em>"1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:</em></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><em>(a)    the identity and the contact details of the controller and, where applicable, of the controller's representative;</em></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><em>(b)    the contact details of the data protection officer, where applicable;</em></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><em>(c)    the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;</em></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><em>(d)    where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;</em></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><em>(e)    the recipients or categories of recipients of the personal data, if any;</em></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><em>(f)    where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.</em></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><br></p>
<!-- /wp:paragraph -->