Data Protection Commission fines Google €403M over processing of location data

The Data Protection Commission (DPC) has imposed a fine of €403 million on Google Ireland Limited for improperly handling location data. This decision follows an own-initiative inquiry launched by the DPC in February 2020, in response to complaints from European consumer rights organizations such as BEUC. The inquiry focused on Google's processing of location data within three specific features between the GDPR's application date, 25 May 2018, and 4 February 2020.

The commissioners, Dr Des Hogan, Mr Dale Sunderland, and Ms Niamh Sweeney, concluded that Google had violated the GDPR.

Location data, which can be derived from tracking an individual's location, encompasses various pieces of personal information. While it can improve the functionality of online services, it also poses risks by exposing sensitive personal details. The GDPR mandates stringent protection of personal data and requires lawful, fair, and transparent processing procedures.

Due to Google's shortcomings, individuals may have been unaware that their location data was being utilized to influence advertisements or infer their interests, thereby undermining their control over personal information. Furthermore, the prolonged retention of location data compounded this loss of control.

Google offers Web & App Activity as a Google account setting, enabling it to process a range of information, including browsing and search histories, along with location data, from users of its services. The Location History feature allows users to keep track of their whereabouts using compatible mobile devices, creating a private map displaying places visited and paths traveled.

Users must opt-in to this service, which saves a record of their location history even when not actively using Google services. Lastly, Location Accuracy enhances Android device location determination beyond GPS inputs, available to all Android users irrespective of Google account status.