Google faces €403m penalty over location data

An Irish data protection regulator has imposed a substantial fine of €403 million on Google Ireland Limited for violations of European Union privacy regulations related to the company's handling of users' location data. The Data Protection Commission (DPC) found that Google failed to comply with the General Data Protection Regulation (GDPR) in terms of lawfulness, fairness, transparency, accountability, and data retention.

The investigation focused on practices associated with Web & App Activity, Location History, and Location Accuracy, covering the period from May 25, 2018, when the GDPR took effect, to February 4, 2020. The DPC determined that Google's practices allowed people to be unaware of their location data being used to shape advertising or infer their interests, reducing their ability to control personal data.

The regulator also found that retaining location information for longer than necessary further diminished user control. Google has six months to bring its processing into compliance with the ruling. The company stated that the case involved policies from an earlier period that have since been altered and expressed intention to appeal aspects of the decision.

Google claims it changed its location-data practices starting in 2019 and implemented tools to simplify user controls, such as automatic data deletion, additional advertising controls, and clearer explanations of how location information is processed. The DPC initiated the investigation independently in February 2020 after receiving complaints from various European consumer organizations, including the European Consumer Organisation (BEUC).

Ireland serves as Google's lead supervisory authority under the GDPR due to the company's principal European establishment in Ireland. The three-member panel of DPC commissioners, Des Hogan, Dale Sunderland, and Niamh Sweeney, delivered the final decision. The DPC declared that Google infringed on the lawfulness and fairness requirements governing location data processed through Web & App Activity and Location History.

The regulator also concluded that Google did not demonstrate compliance with GDPR's lawfulness, fairness, and transparency principles for data processed through Location Accuracy. Transparency violations were found across all three features, while separate problems with retention periods for Web & App Activity and Location History data were identified.

Web & App Activity is a setting that permits Google to process information generated by users' activity across its services, including browsing, searches, and location data. Location History, which users opt into, records location data that can be used to infer visits, movements, and routes and can be viewed through the Timeline feature in Google Maps.

Location Accuracy is an Android function that enhances positioning beyond a device's GPS input by utilizing additional signals. It applies to Android users regardless of whether they hold a Google account. Deputy Commissioner Graham Doyle of the DPC emphasized that location information can enhance digital services' usefulness but also expose sensitive personal information.

He highlighted that the GDPR mandates lawful, fair, and transparent handling of personal data and that Google's shortcomings could leave individuals unaware of how their location data was being used. The €403 million fine stands among the largest penalties imposed by Ireland's privacy regulator since the GDPR's implementation. The DPC has previously imposed higher fines on other major technology platforms and has emerged as one of Europe's most closely monitored regulators due to several large US technology companies basing their European operations in Ireland.

The DPC disclosed that it collaborated with other European supervisory authorities on the Google case and plans to publish the complete decision at a later date. Three other significant statutory inquiries concerning Google are still under examination by the Irish regulator.