Irish DPC Fines Google €403 Million Over Location Tracking
Ireland’s Data Protection Commission (DPC) has fined Google Ireland Limited €403 million after concluding an investigation into the company’s processing of users’ location data. The inquiry examined Google’s practices between May 25, 2018, when the General Data Protection Regulation (GDPR) began applying, and February 4, 2020.
The investigation focused on three Google features: Web & App Activity, Location History, and Location Accuracy. The DPC launched the inquiry on its own initiative after receiving complaints from several European consumer rights organizations, including the European Consumer Organisation, known as BEUC.
The DPC found that Google had breached the GDPR in several areas. In relation to Web & App Activity and Location History, the company was found to have processed location data in a way that was not sufficiently lawful or fair. The regulator also concluded that Google had failed to demonstrate compliance with the GDPR’s accountability requirements concerning Location Accuracy.
Transparency was another central issue. According to the DPC, Google did not provide sufficiently clear information about its processing of location data across all three features. This meant that users might not have fully understood how their location information could be used, including for advertising purposes or to infer personal interests.
The DPC also criticized Google’s retention of location data collected through Web & App Activity and Location History. Keeping location information for longer than necessary can increase the risks to individuals because detailed records may reveal movements, routines, places visited, and other highly private aspects of a person’s life.
Deputy Commissioner Graham Doyle said that location data can improve digital services but can also expose sensitive information about individuals. He added that Google’s failures could have left people unaware of how their data was being used and reduced their ability to control it.
Alongside the €403 million fine, the DPC ordered Google to bring its processing practices into compliance with the GDPR within six months. The regulator said that the full decision would be published in due course. The DPC also acknowledged the cooperation and assistance of other European data protection authorities during the investigation.
