GDPR fines have been levied on some of the world’s top companies. Even with their resources, they were unable to avoid customer data non-compliance - a costly error that we can all learn from. The General Data Protection Regulation (GDPR) is the world’s toughest rule on privacy and safety, so it’s worth knowing how to steer clear of its wrath.
The way customer data is collected, utilized, and controlled has evolved dramatically over the last decade. Web cookies have permitted an incredible rise in the sophistication of ad personalization and targeting, but they have also meant data misuse and privacy violation.
The GDPR, or General Data Protection Regulation, is Europe's top privacy regulation. It went into force in 2018, and numerous corporations have been punished for noncompliance surrounding tracking since then. Here are those top 4 biggest GDPR fines, to date.
Amazon - €746 million ($887 million), 2021
- The complaint was filed by French privacy rights group La Quadrature du Net on behalf of more than 10,000 customers, alleging that Amazon manipulated customers for commercial means by choosing what advertising and information they receive [1].
- The GDPR fine of €746 million ($887 million), announced in the company’s July 2021 earnings report, was nearly 15 times bigger than the previous record at the time. Luxembourg’s National Commission for Data Protection (CNPD) issued the penalty over the way it used customer data for targeted advertising purposes.
- The fine could have been avoided if Amazon had obtained freely given, informed, and unambiguous opt-in permission before setting cookies on its users’ devices.
Due to professional secrecy laws, little is really known about the details of what Amazon has been fined for - we could learn this after the appeal process is complete. What we do know is that Amazon is data hungry!
Amazon's massive expansion has been fueled largely by data from its consumers. When you talk to the Alexa voice assistant, Amazon can gather your name, address, searches, and recordings. It is aware of your orders, Prime material you view, contacts you upload, and email exchanges with it. Cookie trackers are used on its website to "personalize" your experience, but in actuality, this information establishes where you work, where you live, how you spend your free time, and who your family and friends are.
Prices, suggested purchases, and which successful own-label items Amazon decides to develop are all determined by continuous analysis of user data. The more you use Amazon and its services, the better its algorithms can predict who you are and what you are likely to buy next.
Their machine learning software is so good at prediction, that third parties can sign up and pay for a service called Amazon Forecast!
GDPR fines were levied for a series of data protection infringements
WhatsApp - €225 million ($255 million), 2021
- The complaint from the Irish data regulator, the Data Protection Commission (DPC), involved a number of WhatsApp service users and non-users. It included alleged breaches of transparency and data subject information obligations under articles 12, 13, and 14 of the GDPR, specifically that WhatsApp had failed to properly explain its data processing practices in its privacy notice [2]. The examination focused on whether WhatsApp met its GDPR transparency standards, notably regarding the exchange and processing of personal data by and with other Facebook firms.
- The GDPR fine was €225 million ($255 million) and was big enough to knock Google off the number two spot into third place. After referral to the European Data Protection Board (EDPD) under Article 65 GDPR, which oversees the GDPR on a European level, the decision was upheld.
- The fine could have been avoided had WhatsApp provided more clarity within its Legal Basis Notice, ensuring it is “a concise, transparent, intelligible and easily accessible form, using clear and plain language” [2]. WhatsApp, in each applicable processing step, was told to explain its legal reasons for some data processing operations.
WhatsApp was penalized for improperly gathering and sharing user information with Facebook. Furthermore, WhatsApp threatened its users with removal from the site if they did not agree to their data being gathered and shared with Facebook. Some investigations also revealed that WhatsApp has been exchanging data with Facebook for years previously.
The resulting fine didn’t just damage the balance sheet, it deeply hurt the company’s reputation, which has eroded both competitive advantage and consumer loyalty. From such a huge company, it makes you wonder why WhatsApp adopted this customer-data-abuse strategy in the first place.
The oversight might not have been intentional. Did the acquisition from Facebook in 2014 evolve the structures and systems too quickly? It’s difficult to imagine that such a large conglomerate didn’t do its due diligence, and data collection methods should have been at the forefront of system architecture with privacy at top of mind while adapting the businesses.
While the investigation looked at specific breaches of legislation, the focus for all organizations should be less about the jargon and legal compliance, and more on adopting a privacy-first approach that negates abusing consumer data from the start.
Instead of just carefully explaining in simple terms what will be done with the data an individual provides, the key to avoiding GDPR fines (and more importantly, building trust) is by prioritizing a privacy-first culture - adopting ‘privacy by design’ in every aspect of organizational processes and security solutions. Organizations must move toward continuous compliance by stressing these techniques from the top down, safeguarding their bottom lines and sustaining customer confidence.
Using plain language is a great way to avoid GDPR fines
Google Ireland - €150 million ($102 million), 2022
- The complaint was brought by the French data protection authority, France’s Commission Nationale Informatique & Libertés (CNIL) relating to how Google’s European arm implements its cookie consent policy on YouTube. According to the CNIL, denying cookies required multiple clicks, but allowing cookies needed only one click [3].
- The GDPR fine was given to Google Ireland through the EU regulator because it’s the GDPR that decides how website operators obtain consent. The decision was based on an infringement of freedom of consent.
- The fine could have been avoided had Google made it easier for YouTube users to refuse cookies. It should have been as easy to accept as it is to refuse - i.e also with just one click.
To acquire as much personal data as possible, it's tempting to force users to "accept" cookies or make opting out of cookies difficult. Yet, there are much simpler, and more ethical alternatives to ‘stalking’ customers online and ending up with a hefty GDPR fine.
It’s not just essential for Google (and all businesses) to focus on consent-gathering practices to declare how every piece of data is used and for people to easily opt-out; Compliant and accurate zero-party data should become the normal (and only) way to gather data to interact with (potential) customers.
It’s far more successful to maximize the experience of consumers who are engaging at that time, rather than chasing the sale afterward. Using near-real-time behavioral experience data can tell you a lot more about your customers and allows you to make it more relevant for the user.
Don’t get a GDPR fine, get a 1-click cookie opt-out
Facebook €60 million ($68 million), 2022
- The complaint formed part of the same CNIL case against Google Ireland - that not being able to decline cookies as easily as it is to accept them went against Article 82 of the French DPA - Data Protection Act [3].
- The GDPR fine was Facebook’s second largest (including the WhatsApp fine above) for not being able to get proper cookie consent from its users and the language generated confusion. In addition to the fines, the committee ordered the businesses to give Internet users in France a method of refusing cookies as simple as the present method of accepting them. They had three months to do this, otherwise the corporations would be fined 100,000 euros for each day of delay.
- The fine could have been avoided had Facebook been clearer in the way in which it provided cookie opt-outs. Facebook's cookie consent page seemed to provide just "Accept Cookies," even when it looked like users were declining cookies. Facebook should have kept the wording basic and unambiguous.
Existing MarTech must be made privacy-first, and current digital marketing strategies must move away from retargeting, customer analytics, and lead generation - unwanted tactics of Web2 modus operandi that we seem to have all put up with for the last decade or so.
Web3 is getting closer to a digital future where privacy and ownership are a right, not a luxury. Web3's user-to-platform interactions are both confidential and anonymous in theory and reality, meaning it will advance the privacy-first revolution and hopefully make tracking and cookies a thing of the Web2 past.
Our privacy-first solution is designed to protect humankind from Big Tech’s systematic abuse in marketing (Digital Twins, Soulbound Tokens, DID, and similar concepts of protocolization of humans included.) by combining AesirX + Concordium ID Layer to protect users’ personal data; so it cannot be exploited. Now everyone has a choice to use technology that isn’t based on abusive strategies and where ownership of data is 1st party.
We’re working tirelessly on AesirX - evolving Web2 with Web3 to enable the future of privacy-first on the world wide web!
Web2 + Web3 = AesirX
References
[1 ] Securities And Exchange Commission
[2] Clyde & Co, Irish data regulator fines Whatsapp €225m for GDPR infringements
