Data Protection Commission fines Google €403M over processing of location data

Google must now make its location data processing compliant with GDPR rules within six months or face further penalties.

The Data Protection Commission (DPC) of Ireland has fined Google Ireland Limited €403 million for violations of the General Data Protection Regulation (GDPR) related to the processing of user location data. The fine stems from an inquiry launched in February 2020, following complaints from consumer rights groups concerning Google's handling of data from its "Web & App Activity," "Location History," and "Location Accuracy" features. The DPC found that Google infringed GDPR principles regarding the lawfulness, fairness, transparency, and accountability of its data processing. Specifically, the violations included how location data was processed in "Web & App Activity" and "Location History," and transparency failures across all three features. Additionally, Google was found to have retained location data for longer than necessary. The DPC has ordered Google to bring its data processing practices into compliance within six months.

This significant fine underscores the increasing regulatory scrutiny on how major tech companies handle sensitive user data, particularly location information. The DPC's decision signals a stricter enforcement approach by European data protection authorities, potentially impacting how other platforms collect, process, and retain location data to avoid similar penalties. Companies will likely need to re-evaluate their data consent mechanisms and transparency disclosures to ensure compliance with GDPR mandates.

The €403 million penalty and the six-month compliance order could prompt a wave of adjustments across the digital advertising and data analytics sectors, where location data is a key commodity. Users may see more granular control options for their location data or clearer explanations of how it is used, especially in relation to personalized advertising and service enhancements. The ruling also highlights the importance of data minimization and purpose limitation principles within GDPR.