nel caso B7-70721 l’autogirà garante tedesca fa partire un’indagine verso Google per la vioalzione dell’art. 19a.2.4 e art. 32.b.1 della legge concorrenziale tedesca.
Si tratta della decisione 5 ottobre 2023 : vedila in inglese nel sito dell’autorità.
Ex art. 19a.2.4, l’autorità può impedire di
<<4. creating or appreciably raising barriers to market entry or otherwise impeding other undertakings by processing data relevant for competition that have been collected by the undertaking, or demanding terms and conditions that permit such processing, in particular
a) making the use of services conditional on the user agreeing to the processing of data from other services of the undertaking or a third-party provider without giving the user sufficient choice as to whether, how and for what purpose such data are processed;
b) processing data relevant for competition received from other undertakings for purposes other than those necessary for the provision of its own services to these undertakings without giving these undertakings sufficient choice as to whether, how and for what purpose such data are processed;>>
Andiamo ora alle violazioni ravvisarte, sostanzialmente consistenti nella insufficiente scelta data all’utente:
<<(51) .First of all, there is a lack of sufficient granularity in the setting options both when a Google account is created and when Google’s services are used by non-authenticated users. Users do not have the option to opt out of cross-service data processing and to limit the processing of data to the Google end user service in which the data were generated. Users only have the choice to accept personalisation across all services – including data Google collects on third-party websites and apps as well as data Google obtains from third parties – or to opt out of personalisation altogether, also including personalisation based on the data collected in the specific service used. Due to this lack of fine-tuning users cannot make a free choice.19 As a result, they may be tempted to consent to more extensive data processing than they actually wish to accept. The Decision Division has thus reached the preliminary view that insufficient granularity of the choices offered can also result from the fact that no differentiation is possible with regard to different processing purposes.
(52) Furthermore, users are not given sufficient choice within the meaning of Section 19a(2) sentence 1 no. 4a GWB with regard to Google’s data processing terms as in some cases Google offers users no choice at all as to the data processing options, thus not giving any choice with regard to cross-service data processing. When users use a service either by signing in to an account or without an account, Google provides for the possibility of (cross-service) data processing for certain areas without giving users the option of rejecting this.20 Users who wish to use one of Google’s services thus have no choice but to accept cross-service data processing (“take it or leave it”).
(53) Furthermore, the setting options offered by Google – both for signed-in users and for non-authenticated users – lack sufficient transparency. There is a lack of sufficiently concise and comprehensible indications which could provide users with sufficient information as to whether, how and for what purpose Google processes data across services.
The information provided by Google is not sufficient to make users understand
the far-reaching possibilities Google provides for cross-service data processing. In particular, Google does not explain to users which of their data are processed, how they are processed and what is included in the processing purposes. The use of imprecise or unclear terminology and the exclusive reference to examples instead of conclusive definitions contribute to this. In addition, data processing enabled by the users’ consent is presented from a one-sided positive perspective whereas the significant extent of cross-service data processing is not disclosed to users. Users can thus not easily comprehend the scope of the choice options.
(54) Finally, when creating a Google account there is no equivalence of consent and rejection. This is because in the context of the so-called “Express personalisation” users can only accept the data processing option provided for, but have no possibility of rejecting this. Rejection is only possible in the context of the so-called “Manual personalisation”, which requires considerably more clicks. For users it is therefore easier to consent than to reject. In this way, Google exerts an unreasonable influence on the users’ decision so that they have no free choice and no sufficient choice within the meaning of Section 19a(2) sentence 1 no. 4a GWB>>.