Google fined €403m by Irish watchdog over location data GDPR violations

Google has been fined €403 million by Ireland’s Data Protection Commission (DPC) over the way it handled users’ location data, according to the BBC.

The penalty followed an investigation launched six years ago after complaints from several European consumer rights organisations. The DPC said Google’s processing of location data was not “lawful”, “fair” or “transparent”.

What the investigation found

The inquiry examined Google’s processing of location information through three services: Web & App Activity, Location History and Location Accuracy. The practices under review covered the period from 25 May 2018 to 4 February 2020.

Location data can be used to determine a person’s whereabouts and may reveal significant information about an individual, including details that are inherently private, DPC Deputy Commissioner Graham Doyle said.

The watchdog concluded that Google’s practices breached the European Union’s General Data Protection Regulation (GDPR), which took effect on 25 May 2018 and established strict data privacy and security requirements across the bloc.

According to Doyle, users may not have known that their location data was being used to influence them with advertising or infer their interests. The retention of location data for longer than necessary further reduced users’ control over their personal information, he said.

Google says policies have changed

In response, Google said the case concerned historical policies that had since been updated.

“From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple,” the company said.

Google cited features including automatic deletion controls, which allow users to set their accounts to delete data on a rolling three-, 18- or 36-month basis. It also pointed to tools for managing personalised advertising and expanded information about location data practices and account settings.

Alongside the fine, the DPC ordered Google to bring its data processing into compliance with GDPR requirements within six months.