EU regulator fines Google €403 million over location data practices

Ireland’s Data Protection Commission has fined Google €403 million over the processing of users’ location data between May 2018 and February 2020, in a decision taken on behalf of the European Union.

The regulator said Google’s use of location data through Web & App Activity and Location History was unlawful and unfair. It said users may not have understood that their location information could be used to influence advertising or infer their interests, while retaining the data for longer than necessary further reduced their control.

Google has also been ordered to bring its practices into compliance with the EU’s General Data Protection Regulation within six months. The supplied material does not specify how the penalty was calculated or the detailed requirements of the compliance order.

The case followed coordinated complaints lodged in November 2018 by consumer organisations in eight European countries. The European Consumer Organisation welcomed the decision but criticised the time taken to reach it, saying delayed enforcement can be as harmful as no enforcement.

Google said the case concerned historical policies that had since been updated. The company said it had significantly changed its practices from 2019 and introduced tools intended to make location data easier to manage.

Ireland oversees Google at EU level because the company’s European headquarters are in the country. The DPC said three other investigations into Google were at an advanced stage, including one concerning the use of Europeans’ personal data to train artificial intelligence systems.