Google has been fined €403 million by Ireland’s Data Protection Commission following a six-year investigation into the way the technology company collected, processed and stored users’ location data.
The DPC, which serves as Google’s lead data protection regulator in the European Union, opened its investigation in February 2020 after complaints were submitted by several European consumer organisations, including the European Consumer Organisation, known as BEUC.
The investigation examined three Google services: Web & App Activity, Location History and Location Accuracy. Regulators reviewed the company’s practices from May 25, 2018, when the General Data Protection Regulation came into force, through February 4, 2020.
The DPC concluded that Google breached several requirements under the GDPR in its handling of location information.
According to the regulator, Google did not process location data lawfully and fairly through its Web & App Activity and Location History services. It also found that Google had not demonstrated compliance with requirements relating to lawfulness, fairness and transparency for Location Accuracy.
The regulator found shortcomings in Google’s transparency practices across all three services. It also concluded that the company kept users’ location data for longer than was necessary.
DPC Deputy Commissioner Graham Doyle said location information could reveal highly personal details about individuals, particularly when combined with other information held by Google.
He said Google’s failures could have left users unaware that their location data was being used for purposes such as influencing advertising or determining their interests.
Doyle also said keeping location information for longer than necessary had increased the loss of control users could have over their personal data.
Alongside the financial penalty, the DPC has ordered Google to bring its data processing practices into compliance with European data protection rules within six months.
The decision was adopted by Ireland’s Data Protection Commissioners Des Hogan, Dale Sunderland and Niamh Sweeney following cooperation with data protection authorities in other EU member states.
The DPC said it would publish the full decision at a later date.
The €403 million penalty adds to a growing list of regulatory actions against Google in Europe covering data protection, competition and advertising practices. The company has faced scrutiny from regulators across the bloc over how it handles personal information and exercises control over digital services.
The case also highlights the lengthy process involved in major data protection investigations. The inquiry began in 2020 and examined practices dating back to the introduction of the GDPR in 2018.
The ruling comes as European regulators continue to examine the data practices of major technology companies, with location information receiving particular attention because of the detailed picture it can provide about people’s movements, interests and activities.
