DPC fines Google €403m over location data GDPR violations

The Irish Data Protection Commission (DPC) has announced its long-awaited final decision following its investigation into Google's processing of location data. The DPC issued fines totalling €403 million and ordered the technology company to bring its operations into compliance within six months.

The DPC launched an own-volition inquiry under the EU General Data Protection Regulation (GDPR) in February 2020 following several complaints, including from the European Consumer Organisation (BEUC). The investigation focused on Google's processing of location data across three separate product features: Web and App Activity, Location History, and Location Accuracy between 25 May 2018 and 4 February 2020.

The DPC investigation uncovered GDPR violations related to the lawfulness and fairness of processing and data retention practices in Web & App Activity and Location History. In addition, Google violated its accountability requirements to demonstrate compliance with the lawfulness, fairness and transparency principle within its Location History feature. Finally, the DPC found that Google failed to meet transparency requirements across all three product features.

In a statement responding to the news, Google said that it has "significantly evolved our practices and launched robust tools that make managing location data simple," since 2019. 

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.