Irlanda multa a Google con 403 millones por infringir la normativa de protección de datos

The Irish Data Protection Commission (DPC) has fined Google Ireland Limited €403 million for violating the European Union's General Data Protection Regulation (GDPR) while managing users' geolocation data. The regulatory body has given the company six months to bring its data processing operations into line with EU standards. The fine comes after an extensive investigation initiated in February 2020 following numerous complaints by European consumer organizations, including the European Organisation of Consumer Unions (BEUC).

The probe examined the handling of location information obtained via various technical means between May 2018 and February 2020, focusing on three operational functions integrated into the company's ecosystem: "Web and Applications Activity," "Location History," and "Location Accuracy." According to the DPC's resolutions, practices in these areas violated European regulations concerning the legality, fairness, transparency, and accountability in the use of personal data.

The supervisory authority concluded that Google collected and stored location data for longer periods than strictly necessary, resulting in a loss of control for users over their personal information. The regulator determined that default settings and interface flows during the investigated period made it difficult for account holders to understand the extent of geographical tracking.

In response to the Dublin ruling, Google's legal team stated that the investigation concerns practices and configurations developed several years ago. The multinational technology company noted that since 2019, it has implemented changes to data localization management, incorporating user account control tools and introducing options to limit the precision of stored location data in search queries.

The DPC's decision represents one of the largest monetary penalties imposed by the Irish regulator since the GDPR's entry into force in May 2018. The supervisory body, which holds primary jurisdiction over American technology multinationals headquartered in Europe within Irish territory, has accumulated over €4,000 million in financial penalties for privacy infringements.

Consumer associations have praised the imposition of the fine, although they have pointed out the extension of time since the initial complaints. Representatives of these groups argue that the deterrent effectiveness of fines depends on the timeliness of corrective actions to prevent the consolidation of irregular practices in the digital market.

The six-month deadline imposed by the regulator entails a technical review of Google's interfaces, retention policies, and consent mechanisms within the European Economic Area. The company retains the right to appeal the administrative decision in the corresponding courts.