Irish privacy regulator fines Google €403 million over location data processing

On September 21, Ireland's Data Protection Commission (DPC) imposed a substantial fine of €403 million on Google for violating privacy regulations. This penalty, the fourth largest among the €4 billion total fines issued by the DPC since becoming the lead EU regulator for major US tech firms under the 2018 GDPR, concerns the processing of location data.

Google's policy adjustments in this area have since been updated. The DPC found that Google had infringed on EU privacy rules, the General Data Protection Regulation (GDPR), through three specific features from 2018 to 2020. These features included Web & App Activity, Location History, and Location Accuracy. Google's spokesperson clarified that the case centered around historical policies and that the company had implemented robust tools and significantly improved its practices on managing location data since 2019.

Despite this, Google was ordered by the regulator to bring its location data processing into compliance within six months. The DPC's Deputy Commissioner, Graham Doyle, emphasized that individuals could have been unaware that their location was being used for purposes such as influencing ads or inferring interests, potentially losing control over their personal data.

The DPC initiated the inquiry in 2020 following complaints from several European consumer rights organizations, including the pan-European consumers organization BEUC, regarding Google's location data processing.