Now, the Wall Street Journal reports that CNIL “launched a court-like proceeding against Google Inc. that could lead to fines, the most aggressive step yet among a group of European regulators that allege the U.S. Internet company’s handling of user data violates European privacy law.” And it might be possible for CNIL fine Google an amount that would actually hurt the company. The Journal reports, “CNIL didn’t specify the amount of the fine it might seek, but a person briefed on the matter said the agency is considering whether it would be legally possible to count every Google user in France as an infraction—allowing it to multiply France’s data-protection fines beyond the current maximum of €150,000 ($203,000) for first offenses.”
Recall that the information services giant has paid small fines (compared with Google’s earnings) for privacy scandals before. In April 2012, the Federal Communications Commission decided (redacted pdf) that it would not take enforcement action against the company over data collection and retention as part of its online mapping service, Street View, but it would fine Google $25,000 for impeding the agency’s investigation into the private data collected and retained via its Street View product. In March, Google reached a settlement (Connecticut pdf; archive pdf) with 38 states and the District of Columbia over the collection and retention of individuals’ personal data through its Street View product, but the company would only have to pay $7 million total and implement a privacy program.
The Journal reports that CNIL is making the move toward possible fines because “Google had missed a three-month deadline to comply with an order to change its treatment of user data.” Also, “The potential sanctions represent a test case as the European Union considers a new privacy law that would beef up potential fines and unify an enforcement process that is now fragmented across a patchwork of 28 countries. The new privacy law, which could authorize fines of up to 2% of a violator’s world-wide revenue, is headed for a vote in a European Parliament committee in late October.”