Google has been fined €403 million ($435 million) by Ireland's Data Protection Commission (DPC) for violations of the General Data Protection Regulation (GDPR) related to its handling of user location data. The penalty, one of the largest issued by the Irish authority, stems from an inquiry initiated six years ago following complaints from European consumer rights groups.
The DPC's investigation concluded that Google processed location data in a manner that was not "lawful, fair or transparent." The inquiry specifically examined Google's practices concerning location data processing within three features: Web & App Activity, Location History, and Location Accuracy, between May 25, 2018, and February 4, 2020.
Location data, defined as any information that can infer a person's location, can reveal significant personal details. According to DPC Deputy Commissioner Graham Doyle, such data "can reveal a significant amount of information about an individual, including information that is inherently private."
The DPC found that Google's practices infringed upon GDPR, the EU's strict data privacy and security legislation that came into effect on May 25, 2018. Doyle stated that the regulation requires the processing of personal data to be conducted lawfully, fairly, and transparently.
"As a result of Google's failures... individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data," Doyle explained. He added that the "retention of users' location data for longer than necessary aggravated this loss of control."
In addition to the fine, Google has been ordered to bring its data processing practices into compliance with GDPR within six months.