Earlier this week, a German court and Google (GOOG +1.71%) reached an agreement regarding Google's illicit collection of personal data while running its Street View cars through the country. As soon as the news came out, Google stepped up an announced that it agreed with the German courts, and would not appeal their ruling.
The walk of corporate shame had a slightly different tinge to it this time around, though, as the Internet giant had effectively gotten away with it. The ruling-that-it-won't-appeal only fined the company a measly $189,000. There was no reason to appeal -- it would cost more than that in legal fees.
The fine's limit was imposed by current EU regulations that cap penalties at 150,000 euros for multinational companies. In discussing the result, the chief of the Hamburg commission that lead the case said that the fine was "totally inadequate", and highlighted the potential changes that many regulators have called for in the EU.
Limits on damages
The Google ruling may be one of the last big cases under the current system. Pressure has been mounting in the EU to force a change in the limits for damages, and potential legislation would increase the cap to 2% of a company's global turnover. That would be a much more meaningful fine for any company, and would be one that Google would be much more likely to appeal.
The current cap doesn't focus on all fines, just those that stem from breaking EU laws on data protection and management. Companies like Microsoft (MSFT +0.60%) have already been on the receiving end of stricter fines that come from anticompetitive actions. Last year, Microsoft agreed to a $732 million fine based on its failure to include other Internet browser options in some of its Windows releases.
That fine was meaningful and damaging, and the EU wants to be able to make fines for data mismanagement similarly harsh. For its part, Google claimed that it wasn't malicious in its data collection, merely negligent. The company had gathered all sorts of private user information while running its Street View cars through Germany. The final decision against Google highlighted the company's poor internal controls, which led to the collection.
The danger of complacency
The accepted truth in Europe is that if things go unchanged, the EU will continue to hand out small sentences that will never act as a deterrent to future crimes. Instead, companies like Google, Microsoft, and Facebook will continue to collect excess data, and write personal data protection agreements that vastly favor the companies at users' expense.
On top of the weak fines, the EU also needs to get its regulatory house in order. This year's Microsoft decision came down with an admission that the body in change of regulating Microsoft had clearly failed in its task. The company hadn't included the browser options in Windows for months before anyone noticed. In fact, it took over a year for the EU to notice that anything was wrong.
The combination of the loose oversight and the minimal fines make the EU a seemingly lawless realm for data protection. Under current conditions, companies are effectively free to do as they will with no repercussions of note. Something needs to change if anyone is ever going to effectively be held accountable.
