Another Big Tech fine: Google penalised €403m by Irish data watchdog

The Irish Data Protection Commission (DPC) has imposed a substantial fine of €403 million on Google following a six-year investigation into the company's handling of user location data. The DPC, which serves as Google's primary regulator in the EU, launched the inquiry in February 2020 after receiving complaints from various consumer rights groups, including BEUC.

The investigation focused on three Google features: Web & App Activity, Location History, and Location Accuracy, covering the period from May 25, 2018, when the General Data Protection Regulation (GDPR) came into force, to February 4, 2020. The DPC discovered that Google had violated GDPR regulations in several ways. The company was found to have processed location data unlawfully and unfairly through Web & App Activity and Location History, failing to demonstrate compliance with the principle of lawfulness, fairness, and transparency for Location Accuracy.

Additionally, the DPC determined that Google did not meet transparency obligations across all three features and retained users' location data for an excessive duration. Deputy Commissioner Graham Doyle emphasized that location data could expose sensitive personal information about individuals, even when combined indirectly with other data Google possesses.

Regulators highlighted that the extended retention of location data worsened the loss of control over personal information for users. As a consequence, the DPC ordered Google to rectify its data processing practices within six months. The decision was made by Commissioners Des Hogan, Dale Sunderland, and Niamh Sweeney, following collaboration with peer supervisory authorities across the EU.

The DPC plans to publish the full decision in due course. This fine joins a growing list of penalties imposed on Google by Brussels and national regulators in recent years, encompassing antitrust, advertising, and data protection issues. This latest fine arrives at a time of increasing scrutiny of how major tech companies manage user data across the European bloc, with regulators demonstrating growing willingness to impose hefty fines years after an investigation begins.