Google has been fined more than €400 million by Ireland’s Data Protection Commission (DPC) for the way it processed users’ location data.
The DPC launched an inquiry back in 2020 following complaints from European consumer organisations.
The investigation looked at Google’s handling of location data from websites and apps, location history and Google’s “location accuracy” feature.
The regulator found that Google breached the EU’s data protection regulation – the GDPR – in relation to the lawfulness and fairness of processing, transparency, accountability and retention of location data.
It has ordered the company to bring its practices into compliance within six months and to pay a fine of €403 million.
“Location data can bring both benefits and harms to individuals,” said DPC’s Deputy Commissioner, Graham Doyle, “it can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private.”
The DPC concluded that the way Google’s features were set up meant individuals “could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data.”
The European Consumer Organisation, BEUC, led the complaints against Google.
BEUC Director General Agustín Reyna welcomed the decision but criticised the length of time taken to reach it.
“The decision is good news for consumers, as it holds Google accountable and confirms the illegality of the way the tech giant obtained consent to use peoples’ location data,” he said.
But BEUC said reaching the conclusion had taken DPC far too long. “Late enforcement can be as harmful as no enforcement at all,” Agustín Reyna warned.
BEUC said location data could potentially expose highly sensitive details, including information about a person’s health, religion, political views and sexual orientation. It also said Google had made changes globally following the original complaint, but that further concerns led to a second complaint in 2022.
In a statement responding to the fine from the DPC, a spokesperson for Google said:
“This case centres around historical policies that have since been updated. From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple.”
Google has its European headquarters in Ireland so it falls to Ireland’s Data Protection Commission to carry out investigations into alleged unfair or illegal activities. The DPC’s rulings apply Europe wide.