Google fined over €400m by Irish DPC over location data processing

Google has been fined more than €400m (£345m) over the way it processed users’ location data.

The fine, by Ireland’s Data Protection Commission (DPC), comes after complaints from multiple European consumer organisations that Google was following every step users took.

Location-related adverts are familiar to holidaymakers, but seven European consumer organisations had complained that undue use of location data can also lead to a breach of privacy.

Research by the Norwegian consumer agency suggested location data could reveal details such as religious beliefs (by tracking places of worship), political leanings (for example knowing a user has gone to demonstrations), health conditions (if a user has gone to hospital) and sexual orientation (if they have gone to certain bars).

The DPC launched its inquiry six years ago and set out to find out whether Google had a valid legal basis for its use of location data.

It found that Google users could have been unaware that their location was being used to influence them with adverts or to gather details about their health and interests.

“Location data is a type of personal data which is processed by way of location tracking, and includes data collected or processed by Google, which by itself or in conjunction with other information an individual’s location can be inferred,” said Graham Doyle, a deputy commissioner at the DPC.

“Location data can bring both benefits and harms to individuals.

“It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private,” Doyle added.

The European Consumer Organisation based its complaint on research by the Forbrukerrådet, the Norwegian consumer agency, which claimed Google used “various tricks” to ensure location history and web and app activity were enabled.

The DPC inquiry looked at “web and app activity”, “location history” and “location accuracy” between 25 May 2018 and 4 February 2020.

Imposing a fine of €403m, the DPC ordered Google to bring its processing into compliance with the EU’s general data protection regulation (GDPR) within six months.

It is the fourth-largest fine imposed by the Irish regulator, which has EU-wide responsibility for all the US tech giants with EU headquarters in Ireland.

It has previously fined Meta €1.2bn, TikTok €530m and Instagram (also Meta owned) €405m.

Doyle said: “The GDPR provides a high level of protection of personal data throughout the EEA, and requires that the processing of personal data must be carried out in a lawful, fair and transparent manner.

“As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data.

“The retention of users’ location data for longer than necessary aggravated this loss of control,” added Doyle.

There are three other ongoing statutory large-scale inquiries open that concern Google, all of which are at an advanced stage.