.<\/span><\/p>\nThe authority also ordered Google to adapt the contested processing within six months.<\/span><\/p>\nThe case involves a platform and a quantity of data that are difficult to compare with those of an SME. The practical principle, however, is much closer: collecting data also means knowing <\/span>why it is collected, where it is transferred and how long it remains available<\/b>.<\/span><\/p>\nWhy Google was fined for privacy<\/b><\/h2>\n
The DPC investigation was launched in February 2020 following reports from European consumer protection organizations.<\/span><\/p>\nAccording to the authority's decision, Google violated several obligations under the GDPR.<\/span><\/p>\nThe disputes concern:<\/span><\/p>\n\n- lawfulness and correctness of the processing of location data through Web & App Activity and Location History;<\/span><\/li>\n
- accountability obligations relating to Location Accuracy;<\/span><\/li>\n
- transparency of processing for all three features;<\/span><\/li>\n
- location data storage through Web & App Activity and Location History.<\/span><\/li>\n<\/ul>\n
L'<\/span>accountability<\/b>, in the GDPR, indicates the owner's ability to concretely demonstrate that data processing is carried out in compliance with the applicable rules.<\/span><\/p>\nTherefore, it is not enough to establish a procedure internally: you also need to be able to document it.<\/span><\/p>\nWhy location data requires special attention<\/b><\/h2>\n
A single piece of geographic data may seem insignificant.<\/span><\/p>\nA sequence of positions collected over time can instead reconstruct the person's movements, places frequented, and habits.<\/span><\/p>\nThe DPC emphasizes that location data can provide very detailed information about an individual's life and that, in the case analyzed, users may not have fully understood how that information was being used, including to influence the advertising displayed or infer interests.<\/span><\/p>\nIt is precisely the connection between different data that makes treatment mapping important.<\/span><\/p>\nThe same principle applies, on a much smaller scale, to the tools used by a company on a daily basis.<\/span><\/p>\nAfter the contact form the data path continues<\/b><\/h2>\n
On the site a user fills in three fields:<\/span><\/p>\nname, email, telephone.<\/b><\/p>\n
When you press \u201cSend\u201d you will see a confirmation message appear.<\/span><\/p>\nFrom his point of view the operation is finished.<\/span><\/p>\nFrom a technical point of view it may have just begun.<\/span><\/p>\nThe request could arrive via email, be recorded in the CRM, go through an automation, enter a management system, or be transferred to a marketing platform.<\/span><\/p>\nThey are perfectly normal activities when there is a reason for doing them and they are managed properly.<\/span><\/p>\nThe problem arises when no one can reconstruct the complete route.<\/span><\/p>\nA site changes faster than its documentation<\/b><\/h2>\n
A company website rarely remains the same for years.<\/span><\/p>\nA chat is added. The newsletter system is changed. A new module is installed. A CRM is added. A campaign is launched with a dedicated landing page. A booking or support system is connected.<\/span><\/p>\nEach intervention can introduce new steps in information management.<\/span><\/p>\nOver time, a distance can therefore be created between <\/span>what the company plans to use<\/b> and what is technically still connected.<\/span><\/p>\nAn integration created for an old campaign may still be active. A form may continue to save information in the site's database. A platform that is no longer in use may still receive data.<\/span><\/p>\nThis does not automatically mean that a violation exists.<\/span><\/p>\nThis means that before we can establish this, we need to know how the system actually works.<\/span><\/p>\nPrivacy policy and technical operation must match<\/b><\/h2>\n
The presence of a privacy policy alone is not enough to describe actual data processing.<\/span><\/p>\nAs tools, integrations, and platforms are added over time, the documentation also needs to be verified against the actual configuration.<\/span><\/p>\nA comparison between two levels is therefore needed:<\/span><\/p>\nwhat the site states<\/b> is <\/span>what the site actually does<\/b>.<\/span><\/p>\nThe legal assessment is the responsibility of privacy professionals. However, the technical work must provide reliable information on the forms, cookies, platforms, databases, integrations, and services actually used.<\/span><\/p>\nWithout this map, even a regulatory assessment starts from incomplete information.<\/span><\/p>\nHow to check the data path on your site<\/b><\/h2>\n
An initial check can start with a very simple operation: actually fill out one of the site's forms and follow what happens.<\/span><\/p>\nYou have to ask yourself:<\/span><\/p>\n\n- where the request is sent;<\/span><\/li>\n
- if the data is also saved on the site;<\/span><\/li>\n
- if they automatically enter the CRM;<\/span><\/li>\n
- if they are transferred to marketing platforms;<\/span><\/li>\n
- which users can consult them;<\/span><\/li>\n
- if there are exports or automations;<\/span><\/li>\n
- if old additions are still present;<\/span><\/li>\n
- how long the information is retained.<\/span><\/li>\n<\/ul>\n
This exercise does not replace a GDPR audit.<\/span><\/p>\nIt serves to build the technical foundation necessary to do it correctly.<\/span><\/p>\nWhat this means for your business<\/b><\/h2>\n
The Google fine doesn't mean that all data collection is problematic. However, it does demonstrate the importance of understanding the entire information cycle.<\/span><\/p>\nFor an SME, the first checks can be very concrete:<\/span><\/p>\n\n- map forms, CRM, newsletters and related platforms;<\/span><\/li>\n
- check if there are any additions that are no longer necessary;<\/span><\/li>\n
- Compare the technical configuration with the current privacy documentation.<\/span><\/li>\n<\/ul>\n
The useful question is not only <\/span>\u201cWhat data do we collect?\u201d<\/b>, but also <\/span>\u201cWhat happens next?\u201d<\/b>.<\/span><\/p>\nWhen DigiFe intervenes on the<\/span> creation or renovation of a website<\/span><\/a>, analytics isn't just about what the user sees: it also includes integrations, modules, and tools that make the project work behind the interface.<\/span><\/p>","protected":false},"excerpt":{"rendered":"Google, multa da 403 milioni per la privacy: cosa insegna alle aziende La Data Protection Commission irlandese ha sanzionato Google per 403 milioni di euro per violazioni del GDPR legate…<\/p>","protected":false},"author":4,"featured_media":37057,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[59],"tags":[],"class_list":["post-37056","post","type-post","status-publish","format-standard","has-post-thumbnail","category-notizie"],"_links":{"self":[{"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/posts\/37056","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/comments?post=37056"}],"version-history":[{"count":8,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/posts\/37056\/revisions"}],"predecessor-version":[{"id":37350,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/posts\/37056\/revisions\/37350"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/media\/37057"}],"wp:attachment":[{"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/media?parent=37056"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/categories?post=37056"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.digife.it\/en\/wp-json\/wp\/v2\/tags?post=37056"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}