The Spanish Data Protection Agency (AEPD) has fined Vodafone España 3.94 million and Google 10 million euros for failing to follow European data protection rules with their users and customers.
Vodafone España has been fined over sections of the data protection law that relate to the confidentiality and integrity of personal data.
The fine for Google was for what the agency described as two very serious infringements of data protection rules in which the firm for transferred data to third parties without legal base to do so and for hindering citizens’ right to erasure.
Google LLC acted as controller of the analysed processing, which was conducted in the USA. In the case of disclosure of data to third parties, the AEPD has found that Google LLC sent information of requests made to it by citizens, including their identification, e-mail address, the reasons given, and the URL claimed to the Lumen Project. The task of this project is to collect and make available requests for the removal of content, and the Agency therefore considers that, since all the information contained in the citizen’s request is sent for inclusion in another publicly accessible database and for dissemination via a website, “the purpose of exercising the right of erasure results in practice frustrated”.
The decision states that this communication of data by Google LLC to the Lumen Project is imposed on the user who intends to use Google forms, without the option of objecting to it and, therefore, without a valid consent for such communication to be made. Establishing such a condition for the exercise of the right to erasure granted to data subjects is in breach of the General Data Protection Regulation by generating “an additional processing of the data contained in the request for erasure when communicating them to a third party”. Furthermore, in the privacy policy of Google LLC, no mention is made of this processing of personal data of users, nor does communication to Project Lumen appear among the purposes.
To this is added that, submitted the request for the removal of content and the deletion of the personal data having been exercised, “there is no legal grounds for a further processing such as the communication that Google LLC makes to the Lumen Project”.
As regards the exercise of citizens’ rights, the AEPD states in its decision that “it is difficult to infer whether the request is made on the basis of the rules on the protection of personal data, simply because these rules are not mentioned in any of the forms, irrespective of the reason the data subject chooses from the proposed options, except on the form entitled ‘Withdrawal under EU Privacy Law’, the only one available containing an express reference to these rules”.
In addition to the financial penalty imposed in its decision, the Agency has also required Google LLC to put the communication of data to the Lumen Project, the procedures for the exercise of the right of erasure in relation to requests for the removal of content from its products and services, and the information it offers to its users, in line with data protection rules. Furthermore, Google LLC must delete all personal data that have been the subject of a request for the right of erasure communicated to Project Lumen, and it has the obligation to urge the latter to erase and cease the use of the personal data communicated to it.
Looking to revamp your digital transformation strategy? Learn more about Digital Transformation Week taking place in Amsterdam, California, and London, and discover key strategies for making your digital efforts a success.
