Google has been fined €403 million (around $463 million) by Ireland’s Data Protection Commission (DPC) for violating European Union privacy rules over the way it handled users’ location data.
The fine was announced after an investigation into Google’s processing of location data through three features — Web & App Activity, Location History and Location Accuracy. The investigation covered the period from May 25, 2018, when the General Data Protection Regulation (GDPR) came into effect, to February 4, 2020.
What did the regulator find?
The DPC found that Google had not processed location data in a manner that met GDPR requirements for lawfulness, fairness and transparency.
The regulator specifically found issues with the way location data was processed through Web & App Activity and Location History. It also found that Google could not demonstrate compliance with GDPR requirements for the processing of personal data through Location Accuracy.
The regulator also raised concerns about transparency across all three features and the length of time some location data was retained.
How does Google collect location data?
Google’s Web & App Activity setting allows the company to process information about a user’s activity across Google services, websites and apps. This information can include search history, browsing activity and location data.
Location Historymeanwhile, tracks a user’s location when the feature is enabled. It can use location information to identify places a person visits, activities and routes between locations. Google Maps’ Timeline feature can then display this information on a private map.
Location Accuracy is an Android feature that helps devices determine a user’s location more accurately by using multiple sources of location information in addition to GPS.
Why is location data considered sensitive?
Location data can reveal much more than where a person is at a particular moment. A person’s movements can potentially indicate places they visit, their routines and other information about their activities.
The Irish regulator said users could have been unaware that their location information could be used to influence advertising or infer their interests. It also said retaining location data for longer than necessary could further reduce users’ control over their personal information.
What has Google been asked to do?
Apart from imposing the €403 million fine, the DPC has ordered Google to bring the processing covered by the decision into compliance with the GDPR within six months.
Google has said the case concerns historical policies that have since been updated. The company has also introduced changes and additional tools to give users more control over their location data.
The investigation was launched in February 2020 after complaints from several European consumer organisations, including the European Consumer Organisation (BEUC).
Ireland’s DPC acts as Google’s lead data protection regulator in the EU because the company’s European headquarters are located in Dublin. The €403 million penalty is the fourth-largest fine imposed by the Irish regulator.
The DPC said the full decision will be published separately.