Ireland’s Data Protection Commissioner has commenced the first proceeding against the US giant Google since the General Data Protection Regulation entered into force. The case involves processing of users’ personal data for delivery of profiled ads.

The case was launched following numerous complaints, primarily from the makers of the Brave web browser, whose main selling point is built-in ad-blocking tools. The allegations against Google Ireland Ltd boil down to the issue of forwarding users’ personal data (particularly involving their online activity), without their knowledge, to an indefinite number of entities for the purpose of delivering profiled advertising materials.

The Irish regulator will determine whether the processing of personal data by Google’s algorithms at each stage of delivery of profiled ads complies with the GDPR. The case will be examined in terms of the legal grounds for processing the data, the period of processing (retention), and the general principles of transparency and minimisation of data.

Google’s representatives claim that they have implemented strong protections of data privacy, which they consulted with European supervisory authorities. In their view, these measures comply with all the requirements imposed by the GDPR.

Nonetheless, if the allegations against Google are upheld, we may witness record-high fines, which can run up to 4% of global turnover (Google’s turnover in 2018 was about USD 136 billion). Google would also have to rebuild its advertising systems to bring them into compliance with the GDPR.

The result of the proceeding will set a benchmark for all providers of online advertising using a model based on analysis of users’ data.

Michał Nowak