Google is facing one of its largest privacy fines in Europe. The Irish Data Protection Commission (DPC) fined the company a total of €403 million for how it processed users' location data and gave it six months to align its data processing practices with the requirements of the European Union's General Data Protection Regulation, known as the GDPR.
The case relates to the period between 25 May 2018 and 4 February 2020; that is, from the GDPR's entry into force until the end of the period under investigation. The DPC's investigation began in February 2020 after receiving complaints from several European consumer protection organizations, including BEUC.
Three Google features under scrutiny
The Irish probe examined three specific features: Web & App Activity, Location History, and Location Accuracy.
The DPC ultimately found that Google violated the principles of lawful and fair processing for the first two features, Web & App Activity and Location History. The body also held Google responsible for accountability and transparency obligations regarding Location Accuracy and said transparency requirements for all three features were not fully met.
Another issue of concern for the regulator was the retention period for location data. According to the DPC, location information in parts of these services was kept longer than necessary, which further reduced users' control over their personal information.
Why is location data sensitive?
Location information is not just a person's geographic coordinates. By combining location data over time, patterns about where someone lives, works, commutes, and even certain private interests and activities can be revealed.
The DPC also emphasized that while location data offer benefits for improving digital services, they can disclose significant and even private information about individuals. The body said the problems identified in Google's processes could have meant some users were not fully aware of how their location was used, including for influencing advertising or inferring their interests.
Google: this case concerns old policies
In response to the decision, Google said the case relates to the company's historical policies and practices and that it has made significant changes in how it manages location data since 2019.
The company also said it has provided tools to make managing location data easier, give users more control, and features like automatic data deletion, and has reduced the precision of some stored location data.
However, the DPC's new decision is not limited to the fine and requires Google to bring the relevant data processing into GDPR compliance within six months.
According to Reuters, this fine is the fourth-largest ever imposed by the Irish Data Protection Commission. Because Google's European headquarters are in Ireland, the DPC acts as the company's lead supervisory authority under the GDPR in the European Union.
The fine was issued while the DPC continues to conduct three other major investigations into Google at advanced stages; a matter that indicates how the management of users' data by big tech companies remains a focus for European regulators.
For comparison, the largest fine the DPC has imposed to date was Meta's €1.2 billion penalty in 2023. That case concerned the transfer of users' data from the European Union to the United States.