The Irish Data Protection Commission has fined Google Ireland Limited €403 million for breaches of the rules governing the processing of users' geolocation data.
WHAT HAPPENED
According to the Data Protection Commission (DPC), the regulator has completed its investigation into Google. The inquiry concerned the processing of users' location data between 25 May 2018 and 4 February 2020.
The investigation began in February 2020 following complaints from several European consumer protection organisations, including BEUC.
WHICH FEATURES WERE EXAMINED
The regulator examined three Google features: Web & App Activity, Location History and Location Accuracy.
Web & App Activity may process information about a user's activity, including browsing history, search queries and location data.
Location History stores information about places visited, user actions and routes. This information is displayed in the Timeline feature in Google Maps.
Location Accuracy is used in Android to determine a device's location more precisely and is available to users regardless of whether they have a Google account.
WHAT BREACHES THE REGULATOR IDENTIFIED
The DPC found breaches of GDPR requirements regarding the lawfulness and fairness of geolocation data processing, transparency, and the company's accountability for the processing of personal information.
The regulator also flagged issues relating to data retention periods. Its findings suggest that users may not have understood that location information was being used, in particular, to influence advertising or to determine their interests.
WHAT THE REGULATOR DECIDED
Following the investigation, the DPC imposed administrative fines on Google totalling €403 million.
In addition, the company has been ordered to bring its processing of geolocation data into compliance with GDPR requirements within six months. The regulator intends to publish the full decision in the case at a later date.
This is specifically a decision by the supervisory authority. According to the DPC, the fines it imposes become recoverable once confirmed by a court. If appealed, recovery is suspended for the duration of the appeal proceedings.
WHY THIS MATTERS
The decision concerns location data — a category of personal information which, in the DPC's assessment, is capable of revealing a significant amount of information about a person's private life.
The regulator's publication emphasises that GDPR requires personal data to be processed lawfully, fairly and transparently. Compliance with these requirements was the central focus of the investigation into Google.
