Google fined €403 million over EU location data practices
Ireland’s Data Protection Commission ordered Google to bring location data processing into compliance with the GDPR within six months.
Google has been fined €403 million (US$463 million) by Ireland’s Data Protection Commission over the processing, transparency and retention of location data under three services.
The DPC’s investigation examined Web & App Activity, Location History and Location Accuracy. It began in 2020 after complaints from consumer rights groups and covered activity between May 2018 and February 2020.
The regulator found that location data was not processed fairly or lawfully through Web & App Activity and Location History. It also said Google had failed to demonstrate compliance with the GDPR’s lawfulness, fairness and transparency principle for Location Accuracy.
The DPC said Google failed to meet transparency requirements across all three features and breached location data retention rules in Web & App Activity and Location History. Google must make the relevant processing practices compliant with the GDPR within six months.
Google said the case concerned historical policies that had since been updated. The company said it had significantly changed its practices from 2019 onwards and introduced tools intended to make managing location data simpler.
Google’s European headquarters are in Dublin, making the DPC its lead regulator in the European Union. The commission described the penalty as its fourth-largest GDPR fine and said three other large-scale inquiries involving Google remain ongoing.
