Carrez
Definition
HOLDING AND REASONING: (, Chairman) Yes. The GDPR requires accessible, clear, and intelligible communication to users regarding a company’s data processing. Under Article 13 of the GDPR, if a company collects personal data from a user for data processing, the controller is required to, at the time of collection, provide the user with certain information, including the purpose for data processing and the potential recipients of the data. Under Article 12, the necessary information must be provided in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. The purpose of these rules is to ensure that users are aware of the potential consequences of the data collection, allowing them to make informed choices concerning their privacy. If the scope of the data processing is broad and creates a high degree of intrusion into users’ private matters, then it is important that the provided information concerning data collection outline the scope of the processing and the potential effect of any combined processing of different types of data. Here, Google collects a vast array of user data, including data that users input, data generated by users’ activities, and data inferred from those inputs and activities. In combination, the amount of collected data means that data processing is likely to reveal many aspects of a user’s private life, including the user’s lifestyle, contacts, routines, likes, and opinions. In light of the high degree of intrusion on privacy, Google’s information in its Privacy Policy and Terms of Service, the document provided during account creation, is insufficient to allow users to make an informed choice. It lacks information concerning the number and scope of processes being implemented and the potential consequences of those combined data processes. Additionally, the information Google does provide is not readily accessible as required by Article 12. Often, to discern the relevant purposes for data processing, a user must click through multiple links and read through a vast amount of information. Google has breached both the transparency and information obligations imposed by Articles 12 and 13 of the GDPR and is therefore fined €50 million.