Google was hit with a $57 million fine over alleged General Data Protection Regulation violations this week—a hefty price most tech companies would like to avoid.

The financial penalty came from France's data privacy enforcement agency, Commission nationale de l'informatique et des libertés (CNIL), on Monday. It's the first GDPR fine to hit a major U.S. tech company. CNIL said in a press release that the penalty stemmed from a “lack of transparency, inadequate information and lack of valid consent regarding the ads personalization.”

“This Google example should be a red flare to all the other companies, who ask themselves, 'Well, are our notices adequate?'” said Kenneth Citarella, the senior managing director of investigations and cyber forensics at Guidepost Solutions.

Google's alleged violations include not making information on how and why users' data was collected and stored easily accessible to the individual. CNIL's announcement of the fine against Google said the Mountain View, California-based company spread information about personal data processing purposes and storage periods across several documents, making it difficult to find.

A good data consent policy should be easy to find and easy to read, said Rita Heimes, the data protection officer and research director at the International Association of Privacy Professionals.

“Ideally, you can tell them in a couple sentences at the most, or a few words, what it is they're consenting to, right then and there in clear language, so they don't have to click through to another page or several pages to get all the information they need,” Heimes said. “That's very important. If it's confusing and complicated, then that's a big challenge for privacy professionals and general counsel.”

In-house counsel should also check that questions prompted on their company's website aren't pre-ticked to “agree.” Google's fine came in part, according to CNIL, because its questions on ad personalization included a pre-ticked agreement box.

Jacqueline Cooney, a senior director of privacy and cybersecurity at Paul Hastings, said it's crucial that consent be optional. If users can't access a site's services without agreeing to share data that isn't needed for the service, it could be considered nonconsensual under GDPR.

In-house lawyers should consider what data collection processes fall under GDPR and require consent. Consent is not required for all data processing, but once it's asked for and given, it can be withdrawn by users.

“A really good consent policy within [a wider] privacy policy would include … a clear definition of what types of data and what types of data collection points require consent,” Cooney said.

It's important that this message is spread throughout the organization, Citarella said, starting with the board of directors.

Especially in large companies, he said, it's easy for different teams to operate without full knowledge of GDPR or the concept of “privacy by design.” Executives and board members can set the tone that privacy and GDPR compliance aren't optional, and that the company could lose money—and consumer trust—without it.

“It's really, really difficult and it takes vigilance at multiple levels of the corporation,” Citarella said. “And general counsel is the part of the company that is best positioned to assemble all of the other skill sets that are necessary.”

|