Google has been fined €403m (£345m) by the Republic of Ireland’s Data Protection Commission (DPC) over its handling of location data.
The penalty – one of the largest of its kind imposed by the Irish watchdog authority – followed an inquiry launched into the tech giant six years ago, following complaints from several European consumer rights organisations.
On Monday the DPC said its investigation found Google had processed data in a manner that was not “lawful”, “fair” or “transparent”.
The inquiry concerned Google’s processing of location data in three specific features – Web & App Activity, Location History and Location Accuracy between 25 May 2018 to 4 February 2020.
Location data is any kind of data which can be used to infer a person’s location.
It can “reveal a significant amount of information about an individual, including information that is inherently private”, said DPC deputy commissioner Graham Doyle in a statement released on Monday.
The report said Google’s practices “infringed” General Data Protection Regulation (GDPR) – legislation that came into effect on 25 May, 2018, creating strict data privacy and security law within the European Union (EU).
Doyle added: “The GDPR (General Data Protection Regulation) provides a high level of protection of personal data throughout the EEA (European Economic Area), and requires that the processing of personal data must be carried out in a lawful, fair and transparent manner.”
He continued: “As a result of Google’s failures… individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data.
“The retention of users’ location data for longer than necessary aggravated this loss of control.”
In addition to being fined, Google has also been ordered to bring its data processing into compliance within six months.
How have Google responded?
In a statement, Google said: “This case centres around historical policies that have since been updated. From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple.”
They also said they have made data protection improvements in recent years, including “industry-first auto-delete controls”, which enables all users to “set your account to automatically delete your data on a rolling three, 18, or 36-month basis”.
Other measures to safeguard personal data have also been introduced, they said, such as “simple ads management”, which allows you “to turn off personalized ads entirely”, and “increased transparency”, including “consolidated detailed information about our location data practices and account settings”.
