Complaints against Google by consumer organisations for breach of GDPR

On 27th November 2018, the Norwegian Consumer Council and consumer organizations from six other European countries – the Netherlands, Sweden, Greece, Poland, Slovenia and the Czech Republic – each filed a complaint against Google with their respective data protection authority.

The complaints were based on the study "Every step you take: How deceptive design lets Google track users 24/7" carried out by the Norwegian Consumer Council.

The study looks at how Google continuously tracks the location of its users through a number of different technologies and features such as “Location History” and “Web & App Activity”. These settings are integrated into all Google accounts as a personalisation feature, and used to facilitate targeted advertising. The Norwegian Consumer Council claims that consumers are deceived into being tracked when they use Google services. It holds that this happens through information being withheld or hidden, deceptive design practices, and bundling of services.

In its complaint to the Norwegian Data Protection Authority (Datatilsynet), the Norwegian Consumer Council asked Datatilsynet to investigate whether Google is compliant with the requirements of the General Data Protection Regulation (GDPR) and, if not, to impose an effective, proportionate and deterrent fine. In particular, Datatilsynet was asked to investigate whether Google has a lawful legal basis to process location data including for purposes related to advertising (article 6), whether Google is properly informing users of such legal basis and of the purposes for processing (articles 12 and 13), and whether the conditions for a valid consent are met (article 7). It furthermore enquired whether “the design patterns and tricks used by Google” to push consumers to share location data are compatible with the principles on fair and transparent processing (article 5(1)(a)) and of data protection by design and by default (article 25).

It will be interesting to follow how this investigation develops, both in Norway and in the other European countries abovementioned and, if GDPR infringement is found, what the repercussions for Google will be in light of the potentially high fines that may be imposed under the new sanction rules in the GDPR.