Google hit with €403m GDPR fine over location data practices

Google has been fined €403 million by Ireland’s Data Protection Commission (DPC) after an investigation found the technology giant breached the General Data Protection Regulation (GDPR) in its handling of users’ location data.

The decision follows an inquiry launched by the DPC in February 2020 over complaints by European consumer organisations about Google’s processing of location information.

As Google’s lead supervisory authority under the GDPR, the Irish regulator examined how the company processed location data between 25 May 2018 and 4 February 2020 across three features: Web & App Activity, Location History and Location Accuracy.

The DPC found Google had infringed the GDPR in several areas, including the lawfulness and fairness of its processing of location data through Web & App Activity and Location History, as well as its transparency obligations across all three services.

The regulator also concluded Google failed to demonstrate compliance with GDPR accountability requirements relating to Location Accuracy and retained location data collected through Web & App Activity and Location History for longer than necessary.

Alongside the financial penalty, the DPC has ordered Google to bring its processing activities into compliance with the GDPR within six months.

Deputy Commissioner Graham Doyle said location data could significantly enhance digital services but also revealed highly sensitive information about individuals.

“Location data is a type of personal data which is processed by way of location tracking and includes data collected or processed by Google which, by itself or in conjunction with other information, can infer an individual’s location,” he said.

“As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data. The retention of users’ location data for longer than necessary aggravated this loss of control,”

The DPC said it worked closely with other European data protection authorities throughout the investigation and will publish the full decision in due course.