- Google has been fined €403m over its processing of location data between 2018 and 2020.
- Ireland’s data regulator found problems with the lawfulness, fairness and transparency of Google’s practices.
- The case followed complaints from European consumer groups, which said location data could reveal highly sensitive information about users.
Google has been fined €403m (£345m) by Ireland’s Data Protection Commission (DPC) over the way it processed users’ location data, following a lengthy privacy investigation.
The DPC said Google had infringed the EU’s General Data Protection Regulation (GDPR) in its processing of location data through three features: Web & App Activity, Location History and Location Accuracy.
The investigation covered the period from May 25, 2018, when the GDPR came into effect, to February 4, 2020. The DPC formally launched its own-volition inquiry in February 2020 after receiving complaints from several European consumer organisations.
The regulator found that Google had failed to meet GDPR requirements covering the lawfulness and fairness of its processing of location data, transparency and accountability. It also found that Google retained some location data for longer than necessary.
Deputy Commissioner Graham Doyle said location data could provide useful services, but could also expose information that is “inherently private”.
“As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data,” Doyle said in a statement.
The DPC has ordered Google to bring its processing of the relevant location data into compliance with the GDPR within six months. The regulator said the full decision would be published in due course.
What could location data reveal?
The case began with complaints from European consumer organisations, which raised concerns about how Google obtained consent for location tracking.
The complaints were based partly on research by Norway’s consumer organisation Forbrukerrådet, which examined how Google’s settings could encourage Android users to enable location tracking. The research argued that information about where people go could allow companies to draw conclusions about aspects of their private lives.
Location information can reveal much more than where someone happens to be. Tracking visits to hospitals, places of worship, political demonstrations or particular venues could potentially provide clues about a person’s health, religious beliefs, political views or sexual orientation.
The European Consumer Organisation (BEUC), which coordinated complaints from consumer groups across Europe, described geolocation data as one of the most invasive forms of commercial surveillance.
BEUC director general Agustín Reyna welcomed the DPC decision, while criticising the time taken to reach it.
“The time needed to come to this conclusion is disproportionate with the seriousness of the infringement,” Reyna said in a statement. “Late enforcement can be as harmful as no enforcement at all.”
The original complaints were filed in November 2018 by consumer organisations in several European countries, including Norway, the Netherlands, Greece, the Czech Republic, Slovenia, Poland, Sweden and Denmark. The DPC later became responsible for the investigation because Google’s European operations are based in Ireland.
Google said the case related to historical policies that have since been changed.
“This case centres around historical policies that have since been updated. From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple,” a Google spokesperson said.
The DPC’s decision adds to a long list of major privacy penalties involving large technology companies overseen by the Irish regulator. It has previously fined Meta, TikTok and other major platforms over breaches of European data protection rules.
The latest case also highlights the difficulty of regulating the vast amounts of personal information generated by everyday digital services. For users, location data can make maps, search and other services more useful, while the same information can provide companies with detailed insights into where people go and what they may be interested in.
The DPC said Google must now take steps to bring the processing covered by the decision into compliance with the GDPR within six months.
