Google Fined €403m by Ireland Over Location Data Privacy Violations

Google has been fined €403 million (£345 million) by Ireland’s Data Protection Commission (DPC) over violations involving its handling of users’ location data.

The penalty followed a six-year investigation launched after complaints from several European consumer rights organisations, according to a BBC report.

The DPC said its investigation found that Google had processed location data in a manner that was not lawful, fair or transparent, in breach of the European Union’s General Data Protection Regulation (GDPR).

The investigation examined Google’s processing of location data through three features—Web & App Activity, Location History and Location Accuracy—between May 25, 2018, and February 4, 2020.

According to the regulator, location data can reveal significant information about individuals, including details considered inherently private.

Graham Doyle, Deputy Commissioner of the DPC, said the GDPR requires personal data to be processed lawfully, fairly and transparently.

He explained that Google’s practices violated the regulation, which took effect on May 25, 2018, and established strict data privacy and security requirements across the European Economic Area.

Doyle said Google’s practices could have left users unaware that their location data was being used for purposes such as influencing advertisements or inferring their interests.

He added that retaining location data longer than necessary could further undermine individuals’ control over their personal information.

In addition to the financial penalty, the DPC ordered Google to bring its data processing practices into compliance with the GDPR within six months.

Reacting to the decision, Google said the case concerned historical policies that had since been updated.

“From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple,” the technology company said.

Google highlighted several measures introduced to strengthen data protection, including automatic deletion controls that allow users to set their accounts to delete data on a rolling three-, 18- or 36-month basis.

The company also cited simplified advertising controls, which enable users to disable personalised advertisements, alongside increased transparency regarding its location data practices and account settings.