On December 7^th, 2020, the CNIL (French Data Protection Authority) sanctioned the companies GOOGLE LLC and GOOGLE IRELAND LIMITED with a total fine of 100 million euros, highest sanction ever pronounced by the authority. On the same day, the CNIL also issued a 35 million euros sanction against AMAZON EUROPE CORE.

At issue: the placing of advertising cookies on the computers of users of the search engine google.fr and of the amazon.fr website, without prior consent or satisfactory information.

The CNIL sanctioned the company GOOGLE LLC with a fine of 60 million euros and the company GOOGLE IRELAND LIMITED with a fine of 40 million euros, made public. The CNIL holds GOOGLE LLC and GOOGLE IRELAND LIMITED jointly responsible as they both determine the purposes and means related to the use of cookies. For AMAZON EUROPE CORE, the fine amounts to 35 million euros, which has also been made public.

Non-compliance with the e-privacy directive: Interestingly enough the CNIL procedure was not based on the GDPR but on the “ePrivacy” directive, transposed in article 82 of the French Data Protection Act. Because of this legal basis, the CNIL was able to take the hand of the Irish and the Luxembourgish Data Protection Authorities, considering that the one-stop-shop mechanism provided for by the GDPR was not applicable in this case.

In its decision, the CNIL reiterated its jurisdiction to control and sanction cookies placed by companies on the computers of users residing in France. The supervisory authority thus considered that it was territorially competent pursuant to article 3 of the French Data Protection Act, because the use of cookies was carried out as part of the activities of the company GOOGLE FRANCE which constitutes the establishment on French territory of the companies GOOGLE LLC and GOOGLE IRELAND LIMITED and ensures the promotion of their products and services.

What’s next: The CNIL has given Google companies a 3-month deadline to comply with the French Data Protection Act, under penalty of €100,000 per day of default.

From the date of notification or publication of the decision, the sanctioned organizations have the possibility to file an appeal before French highest administrative court (the Conseil d’Etat) within two months. Yet, it is important to note that the CNIL decision is enforceable as soon as it is notified, and the appeal has no suspensive effect. As a result of the appeal, the Conseil d’Etat has the power not only to annul or confirm the decision of the CNIL, but also to modify it. This procedure may take a relatively long time, emergency recourses are also possible.

Under the emergency procedure, the référé-suspension allows to ask the Conseil d’Etat to temporarily suspend the execution of an administrative decision pending a verdict on the merits. In order for such summary proceedings to succeed, the decision must be the subject of a motion for annulment or reversal, the urgency justifies this procedure and there must be serious doubt as to its legality. Depending on the degree of urgency, the decision to suspend the execution of the decision may be taken within a period ranging from 48 hours to 1 month.

Another emergency procedure is the référé-liberté, which allows the judge in charge of the Conseil d’Etat  to take all necessary measures to safeguard a fundamental freedom that the restricted formation of the CNIL would have seriously and obviously illegally infringed. To be able to engage such a summary proceedings, it is necessary not only to justify an emergency making necessary a fast intervention of the judge, but also to show that a fundamental freedom is in question and that the violation which is carried out is serious and obviously illegal. The judge in charge of the summary proceedings then pronounces within 48 hours.

As a reminder, Google had already appealed a CNIL decision last year, after being imposed a penalty of 50 million euros. However, it was unsuccessful as the Conseil d’Etat  had validated the sentence a few months later.