On 27 June last, the European Commission imposed a EUR 2,424,495,000 fine on Google for allegedly abusing its dominant position on the market for Internet search engines. Since, illustrious antitrust experts have discussed the merits of the case and Googe’s odds in Court, two aspects that are not necessarily linked. As one learned author put it, the European Courts often cannot be bothered to review the Commission’s economic analysis but are always on the lookout for procedural quirks, of which there were many in this case.
A far less discussed aspect is the call effect of this fine in a very different area altogether: privacy. Indeed, pursuant to Article 83 of the EU General Data Protection Regulation (GDPR), national supervisory authorities (DPAs) may impose heavy fines for infringements. The GDPR clearly drew inspiration from EU antitrust rules, defining the ceiling for such fines as ‘20,000,000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher’.
The Article 29 Group is busy drawing up guidelines, procedures and templates for imposing such fines, which must be ‘effective, proportionate and dissuasive’. This Group gathers representatives from each of the 28 EU DPAs and the European Commission. The duration of this endeavour alone seems to show that Member States are not overly eager to pin Damocles’ sword over their companies’ heads. Likewise, the Spanish DPA has already stated that it pursues ‘a qualitative change in our goals, endeavouring to be less of a fining body but rather one that inspires trust.’
Given the very high and expensive privacy standard that the GDPR seeks to enforce, deterring fines are arguably the only really persuasive argument for companies to comply. The European Commission does not have the means to force national DPAs to levy such fines. But its €2,424,495,000 fine, albeit for an antitrust infringement, does signal to DPAs that they should not fear a Melian Dialogue of sorts with the US data behemoth.
Two for the Show…