Irish regulator fines Google €403 million over location data

Ireland’s Data Protection Commission (DPC) has fined Google €403 million following an investigation into how the company processed users’ location data. The regulator found infringements of the EU General Data Protection Regulation (GDPR) covering lawfulness, fairness, transparency and data retention.

The decision, issued on 21 September, follows complaints submitted in November 2018 by seven European consumer organisations from the BEUC network. The complaints concerned Google’s location tracking practices and were based on research by Norway’s Forbrukerrådet. The DPC later became the lead supervisory authority and opened its own inquiry in February 2020.

The investigation examined three Google features: Web & App Activity, Location History, now known as Timeline, and Location Accuracy. Web & App Activity can store activity across Google services together with associated location information. Location History can record visits and routes. Location Accuracy uses signals such as Wi-Fi access points, mobile networks, GPS and device sensors to estimate a device’s location.

The DPC found that Google breached GDPR requirements on lawfulness and fairness through its processing under Web & App Activity and Location History. It also found transparency infringements across all three features. For Location Accuracy, the regulator said Google had not demonstrated compliance with the relevant lawfulness, fairness and transparency requirements. The DPC also identified infringements relating to the retention of location data under Web & App Activity and Location History.

Alongside the €403 million in administrative fines, the DPC ordered Google to bring the processing covered by the decision into compliance within six months.

Location data and privacy

The DPC highlighted the sensitivity of location information because it can reveal where an individual is and, when combined with other information, provide insights into aspects of their private life. Deputy Commissioner Graham Doyle noted that location data can make online services more useful but can also expose significant information about individuals.

Google told Reuters that the case concerns historical policies and said it had substantially changed its location-data practices since 2019. The company pointed to measures including automatic deletion controls, storing Timeline data on users’ devices and changes to the use of location information for advertising.

The DPC has not yet published the full decision. Its detailed legal reasoning and the precise basis for the individual infringements and fines will be available when the decision is released.