Published on
Google has been fined €403 million by Ireland’s Data Protection Commission (DPC) after a six-year investigation into how the tech giant tracked and stored users’ location data.
The DPC, which acts as Google’s lead regulator in the EU, launched the inquiry in February 2020 following complaints from several European consumer rights groups, including BEUC.
Investigators examined three Google features, including Web & App Activity, Location History and Location Accuracy, and covering the period from 25 May 2018 when the GDPR came into force to 4 February 2020.
‘Loss of control’ over personal data
The DPC found Google had breached the GDPR on multiple fronts.
Regulators concluded the company failed to process location data lawfully and fairly through Web & App Activity and Location History, and failed to demonstrate compliance with the lawfulness, fairness and transparency principle for Location Accuracy.
The DPC also found Google fell short of its transparency obligations across all three features, and retained users’ location data for longer than necessary.
Deputy Commissioner Graham Doyle said location data could reveal deeply personal information about individuals, even when combined only indirectly with other data Google holds.
“As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data,” Doyle said.
“The retention of users’ location data for longer than necessary aggravated this loss of control,” he added.
Six-month deadline to comply
Alongside the fine, the DPC has ordered Google to bring its data processing practices into compliance within six months.
The decision was made by the Commissioners for Data Protection, Des Hogan, Dale Sunderland and Niamh Sweeney, and follows cooperation with peer supervisory authorities across the EU.
The DPC said it would publish the full decision in due course.
The fine adds to a lengthening list of penalties Brussels and national regulators have imposed on Google in recent years, spanning antitrust, advertising and data protection.
It also lands at a moment of intensifying scrutiny of how tech giants handle user data across the bloc, with regulators increasingly willing to issue large fines years after an investigation first opens.