Diritti interna

Doveri interna

ricerca avanzata

Injunction and Order Issued Against Google Inc. - 18 December 2013 [3133945]

[doc. web n. 3133945]

Injunction and Order Issued Against Google Inc. - 18 December 2013

THE ITALIAN DATA PROTECTION AUTHORITY,

Having convened today, in the presence of Mr. Antonello Soro, President, Ms. Augusta Iannini, Vice-President, Ms. Giovanna Bianchi Clerici and Prof. Licia Califano, Members, and Mr. Giuseppe Busia, Secretary General;

Having regard to the decision adopted by the Italian DPA on 15 October 2010 under the terms of Sections 143(1), letter b), and 154(1), letter c), of legislative decree No. 196 of 30 June 2003 containing the consolidated Personal Data Protection Code (hereinafter, the "Code") in respect of Google Inc., whose contents shall be considered to be an integral part hereof by way of reference;

Having regard to the Notice of Enforcement No. 131/68759 of 4 January 2011 as issued in respect of  Google Inc., a company with registered office in Mountain View, California 94043-1351, USA, 1600 Amphitheatre Parkway (hereinafter, "Google") and served on the aforesaid entity at the address named above on 2 February 2011 (and on the company´s chosen domicile at the Hogan Lovells Law Firm), whose contents shall be considered to be an integral part hereof by way of reference, which mentioned the violation, among other things, of the obligations arising from the joint application of Sections 13, 161 and 164a, paragraph2, of the Code – i.e., the unsuitability of the information provided to data subjects by taking account of the especially large database relied upon in connection with the data collected by Google via the so-called Google cars as part of the service called Street View;

Having regard to the pleadings submitted on 3 February 2011 under the terms of Section 18 of Law No. 689 of 24 November 1981, which shall be considered to be an integral part hereof by way of reference;

Taking note that as of 7 March 2011 Google paid a reduced fine for the violations mentioned in Chapter a) of the Notice of Enforcement, in pursuance of Section 16 of Law No. 689/1981, which terminated the relevant sanctioning procedure; whereas, accordingly, this order only concerns the residual violation under Chapter b) of the aforementioned Notice of Enforcement;

Having regard to the minutes of the hearing of Google´s representatives held on 16 September 2013 pursuant to Section 18(2) of Law No. 689/1981;

Noting that Google declared the following, among other things, in the aforementioned pleadings:

a) "ever since [Street View] was launched, Google adopted a global privacy policy […]. Since this is a global, centrally managed service, it was difficult for Google to take account of all the privacy laws in the individual jurisdictions where the service is provided and meet all the individual requirements of such laws. Accordingly, it was decided to find a minimum common denominator that could take into account the key components in safeguarding users´ privacy […] and the operational requirements of the system";

b) "irrespective of the application of the Italian privacy legislation to Google Inc. regarding the Street View service, it was considered – in good faith – that the measures deployed by the company […] would be enough as was the case with the other online services made available to users";

c) "in its decision [of 15 October 2010] the Garante found that the above measures were not enough to ensure that citizens (non-users) would be fully aware that Street View cars were driving by and could exercise their right not to be included in the snapshots of streets and squares";

d) "as well as requiring ad-hoc authorisations, any other type of notice (e.g. sound alerts, targeted ads, etc.) might have caused confusion on the actual scope of the service, public safety issues or even speculation";

e) "the emphasis given by media to Street View […] both prior to its launch in Italy and in its first months of operation led the company to consider that the majority of the Italian population were quite aware of what Street View was and how the service was operating […which made accordingly…] unnecessary any additional publicity";

f) The company emphasized "the collaborative and dedicated approach Google has ever followed vis-à-vis the Garante [also by way of the] many meetings and the correspondence exchanged […] in order to implement in the most correct way the measures requested by the Garante to protect citizens´ and users´ privacy.";

Whereas in the course of the aforementioned hearing, Google

a) Filed an additional document describing, once again, the steps taken by the company following the facts at issue with particular regard to the ads published from time to time on newspapers whenever Google cars were expected to be passing in a given area and to the notices broadcast via radio stations;

b) Stated that "complying with the measures specified by the Garante entailed substantial costs in the two years from the enforcement notice, amounting to several tens of thousands of Euro. For instance, the cost of an ad per individual location is about Euro 2,000";

Noting that the conduct at issue was determined by the Garante to be unlawful as per the decision of 15 October 2010, which was not challenged by the company; that the company applied for the penalties to be lifted both in the pleadings and during the hearing on account of the reasons specified above; that the company requested, alternatively, minimum level penalties to be imposed by claiming, in short, that it was impossible to provide information in accordance with Section 13 of the Code and that it had acted in good faith;

Considering, as for the foregoing issues, that the preconditions for a justifiable error as per Section 3 of Law No. 689/1981 are not met because no positive elements were provided by entities other than the offender such as to lead the latter to believe, without his or her fault, that the conduct at issue was lawful (see decision No. 1151 by the Court of Cassation, Civil division, I, 11 February 1999) and, further, because no evidence can be found in the conduct followed by the offender to the effect that he or she did all that was possible to comply with the law and is in no way to be blamed, so that the error was incurred without the offender´s being at fault or else was not such as to be avoided by the offender acting with reasonable care and diligence (see decision No. 16320 by the Court of Cassation, Civil division, Labour section, 12 July 2010).

Considering, accordingly, that the justifications submitted by Google are not such as to rule out that the company was liable for the breaches at issue, on the grounds that are expounded in the aforementioned decision by the Garante and summed up in the foregoing paragraphs;

Noting, accordingly, that Google in its capacity as data controller processed data subjects´ personal data unlawfully because it provided information to such data subjects in a manner that was not appropriate under the terms of Section 13 of the Code;

Having also regard to the "peculiarities of the pictures taken by Google Inc., which are disseminated online for long and may be enlarged to enable detailed views by users" as well as to "the many complaints lodged with this Authority concerning image acquisition by Google Inc., since the pictures taken by the latter also captured identifiable individuals who did not wish to appear in the images posted online by Google" (see the Garante´s decision of 15 October 2010);

Whereas given the mechanisms of the processing at issue, Google repeatedly violated  the provisions on information notices under Section 13 of the Code, which carry the penalties set out in Section 161 thereof, and that the said violations were committed with regard to the data the company was using to provide its services, in particular via the Street View service that, given its features, can be regarded as an especially large-sized database pursuant to Section 164-bis, paragraph 2, of the Code;

Taking note of the statements and documents Google submitted regarding the conduct followed by the company after the notice of enforcement was served for the violations at issue – that is, the fact that the company complied promptly with the measures required by the Garante for the Street View service via its decision of 15 October 2010, including the appointment of a representative in Italy, the drafting of an information notice to be provided to data subjects both via Google´s website and through media (newspapers, radio stations), and the arrangements to enhance visibility of Google Cars during the taking of pictures;

Having regard to Section 161 of the Code, which punishes the violation of the provisions contained in Section 13 thereof by an administrative sanction consisting in payment of a fine ranging between Euro six thousand and thirty-six thousand;

Having regard to Section 164-bis, paragraph 2, of the Code, whereby if one or more provisions set forth in Chapter I of Title III of Part III of the Code –  including Section 161 – are violated repeatedly, also on different occasions, in connection with especially important and/or large databases, an administrative penalty is applied consisting in payment of a fine of between Euro fifty thousand and three hundred thousand, whilst reduction of the applicable fine shall not be allowed;

Whereas in calculating the amount of the fine one has to take account, under Section 11 of Law No. 689/1981, of the steps taken by the offender to mitigate or eliminate the consequences of the violation(s), the severity of such violation(s), and the offender´s personality and financial status;

Whereas in the case under scrutiny

a) Regarding severity, the violation does not appear to entail any special features as to its factual commission, whilst the circumstances below have to be taken into consideration in  assessing  the harm or danger produced and the impact of the mental element and they are such as to entail an increase in the sanction to be imposed – namely

- The violation at issue concerns processing operations that impact a substantial number of personal data relating to users and other individuals, acquired in many areas of the Italian territory, and intended for their subsequent dissemination;

-  The negligence-related mental element is to be attached increased importance in the violation at issue on account of the fact that a company such as Google whose business is grounded mainly in data processing, representing one of the leading world providers of information society services, is expected to take the utmost care and diligence in complying with data protection obligations, partly because of the potentially substantial impact of any violation;

b) Regarding the assessment of the steps taken by the offender, the conduct held by the company is to be evaluated favourably because it promptly took the measures it had failed to implement beforehand and collaborated thoroughly with the Garante as related to this decision;

c) Regarding the offender´s personality, the fact that no precedents are on record in connection with violations of the Code is to be evaluated favourably;

d) Regarding the offender´s financial status, and in order to adjust the fine to the offender´s actual economic potential in pursuance of the equality principle, the information contained in the company´s consolidated financial statements for the year ended at 31 December 2012 must be taken into consideration and is such as to entail an increase in the said fine by having regard to the considerable turnover and profits;

Considering that the amount of the fine is to be set at Euro 250,000 (two hundred and fifty thousand) under Section 11 of Law No. 689/1981, in the light of the severity of the offence as determined on the basis of the aforementioned features;

Having regard to Section 164-bis, paragraph 4, of the Code, whereby the administrative sanctions mentioned in Chapter I, Title III of the Code may be increased up to four times as much if they may prove ineffective on account of the offender´s financial status;

Considering that the assessment of the offender´s financial status can be performed on the basis of the corporate classification criteria set out in the decree by the Minister of Production Activities of 18 April 2005 concerning "Adaptation of the classification criteria for SMEs to EU legislation", whereby a large-sized enterprise is any enterprise above the threshold parameters mentioned therein;

Noting that the imposition of the above fine on Google would prove ineffective because of the company´s financial status, since the company´s consolidated turnover for 2012 was in excess of 50 billion dollars and consolidated profits totaled over 10.7 billion dollars – as per the company´s financial statements for the financial year ended at 31 December 2012;

Considering that, in the case at issue, the conditions are fulfilled for the increase mentioned in Section 164-bis, paragraph 4, of the Code, to the effect of raising the fine to four times the initial amount, that is to Euro 1,000,000 (one million);

Having regard to the records on file;

Having regard to Law No. 689/1981 including its subsequent amendments and additions;

Having regard to the considerations made by the Secretary General on behalf of the Office, pursuant to Article 15 of the Garante´s Rules of Procedure No. 1/2000 as adopted by a resolution of 28 June 2000;

Acting on the report submitted by Ms. Augusta Iannini,

ORDERS

Google Inc., having its registered office in Mountain View, California 94043-1351, United States of America, 1600 Amphitheatre Parkway, by the agency of its interim legal representative, to pay Euro 1,000,000 (one million), this being the pecuniary sanction imposed under administrative law on account of the violation of the provisions resulting jointly from Sections 13, 161 and 164-bis, paragraph 2, of the Code, for the reasons set out in the foregoing premises;

ENJOINS

The aforementioned company to pay the amount of Euro 1,000,000 (one million) in accordance with the arrangements specified in the attachment hereto by 30 days from service of this order, under penalty of the enforcement measures provided for in Section 27 of Law No. 689/1981, and requires that documentary proof of the said payment be sent to this Authority, either in original or in a copy certified true, by 10 (ten) days from performing the payment.

Under Section 152 of the Code and Section 10 of legislative decree No. 150/2011, this order may be challenged before judicial authorities by filing a claim with the court having jurisdiction over the place where the data controller is resident within thirty days as from the date on which the order is notified, or within sixty days from the latter date if the claimant is resident abroad.

Done in Rome, this 18th day of the month of December 2013

The President
Soro

The Rapporteur
Iannini

The Secretary General
Busia