Google hit with €403m fine by Irish data watchdog over GDPR violations

The Irish Data Protection Commission (DPC) has levied a substantial €403 million fine on Google for violating the General Data Protection Regulation (GDPR) concerning the handling of location data. This one of the largest penalties imposed by the Irish watchdog, sparked after complaints from various European consumer rights organizations.

The DPC's investigation, initiated six years ago, uncovered that Google had processed the data in an unlawful, unfair, and non-transparent manner, specifically between May 25, 2018, and February 4, 2020.

Location data refers to any information that can be used to determine a person's location, which can reveal significant and potentially private details about an individual. The DPC deputy commissioner, Graham Doyle, emphasized that the retention of users' location data for longer periods than necessary heightened the loss of control over personal data.

Google's failure to comply with GDPR led to the loss of control for individuals, who might have been unaware that their location was being used to influence ads or infer their interests.

The DPC ordered Google to rectify its data processing within six months. The tech giant acknowledged the case's focus on historical policies that have since been revised. Since 2019, Google has significantly updated its practices, introducing robust tools for managing location data and providing users with simple controls. The company also disclosed additional measures to safeguard personal data, such as industry-first auto-delete controls and more straightforward ad management, enabling users to turn off personalized ads entirely.