Ireland’s Data Protection Commission (DPC) has fined Google €403 million after finding that the company violated multiple GDPR requirements while processing users’ location data.
The regulator also ordered Google to bring the affected processing practices into compliance within six months.
The decision follows an own-volition inquiry launched by the DPC in February 2020 after complaints from several European consumer rights organizations, including BEUC. As Google Ireland Limited’s lead supervisory authority in the European Union, the DPC examined how the company processed location information between May 25, 2018, when the GDPR became applicable, and February 4, 2020.
The investigation focused on three Google features: Web & App Activity, Location History, and Location Accuracy.
Google Ireland Limited is Google's European arm, and its services include Search, Maps, Android, YouTube, advertising platforms, and other widely used online products. Because the company’s European headquarters are in Ireland, the Irish DPC acts as its lead privacy regulator for many cross-border GDPR matters.
The DPC's commissioners adopted a final decision finding infringements relating to the lawfulness, fairness, transparency, accountability, and retention of location data.
According to the DPC, Google failed to lawfully and fairly process location data collected through Web & App Activity and Location History. It also failed to demonstrate compliance with GDPR requirements governing its use of personal data through Location Accuracy.
The regulator additionally found transparency violations affecting all three features and concluded that Google retained location information collected through Web & App Activity and Location History for longer than necessary.
Web & App Activity is an account setting that can store activity information across Google services, including searches, browsing activity, and location data. Location History, which users must enable, records device location information and can infer visits, movements, and routes displayed through the Timeline feature in Google Maps.
Location Accuracy is an Android feature that combines signals beyond a device’s GPS hardware to determine location more precisely. Unlike the other two features, it can be used on Android devices regardless of whether the user has a Google Account.
DPC Deputy Commissioner Graham Doyle said location information can reveal highly private details about individuals. He warned that inadequate transparency could leave users unaware that their location data was being used for purposes such as advertising or interest inference.
The DPC said Google must correct the infringements within six months. The DPC will publish its full decision at a later date.
Users concerned about location tracking should review their Google activity controls, turn off unnecessary location-related settings, delete previously stored location history where appropriate, and check retention or auto-delete options for account activity.
Leave a Reply