Written by Susan Foster, Solicitor England & Wales/Admitted in California
The immediate consequences for Google in terms of potential financial penalties are negligible for a company of its size. Each of the national authorities can levy fines, but they are capped under current law. For example, the maximum fine in the UK is only £500,000. Things would be quite different under the proposed Data Protection Regulation, where EU-wide fines could be as high as two percent of worldwide turnover. See our earlier articles on the draft Regulation here and here.
But pending the introduction of more meaningful fines, the current investigation of Google is about fundamental points of principle (user consent and the viability of a global policy) that could have a widespread effect on companies that do any business with European customers as well as companies with actual operations in Europe.
Google has put together a global policy that attempts to satisfy requirements around the world. The EU data protection authorities say it isn’t good enough for their residents. Will Google be forced to adopt potentially more restrictive policies on a global basis in order to satisfy the EU and keep its desired approach of a single cross-service global policy? Or will Google end up creating a special policy for Europe? Or will the EU regulators be forced to back down – as might happen, if, for example, Google threatened to curtail EU residents access to certain services if Google’s terms and conditions, including its privacy policies, aren’t accepted in the EU? (Google is not on the record as having made any such threat, but it’s an interesting scenario to consider.)
At the end of the day, the Google investigation will test the EU’s proposition that it intends to set the gold standard for data protection regulation around the world. It may also test whether the EU regulators can bring themselves to accept that a vast majority of EU residents might be entirely happy to consent to uses of their personal data that offend the regulators – and that EU residents might actually be fully competent to make that decision for themselves.