Key Takeaways
- Google fined €403 million by Ireland’s Data Protection Commission for GDPR violations.
- The fine is the fourth largest since the 2018 GDPR came into effect.
- Google has six months to bring its processing into compliance.
The Irish Data Protection Commission has fined Google €403 million ($463 million) for breaches of the General Data Protection Regulation (GDPR) related to the processing of location data. The fine is the fourth largest since the strict GDPR regulations came into effect in 2018.
According to the Irish watchdog, Google infringed EU privacy rules through three specific features: ‘Web & App Activity’, ‘Location History’, and ‘Location Accuracy’. The investigation, initiated in 2020 following complaints from several European consumer rights organisations, found that Google’s practices allowed users to lose control over their personal data.
The DPC’s Deputy Commissioner, Graham Doyle, stated, 'The retention of users’ location data for longer than necessary aggravated this loss of control.' The company was ordered to bring its processing into compliance within six months.
Google’s ‘Web & App Activity’ feature processes information related to users’ activity on Google services, while ‘Location History’ tracks users’ location through mobile devices. These features were found to be non-compliant with GDPR requirements.
The DPC highlighted that individuals could have been unaware that their location was being used to influence them with ads or to infer their interests, thereby losing control over their personal data. The company did not immediately respond to a Reuters request for comment.
This fine comes as Google faces three other ongoing statutory inquiries, all at an advanced stage. The DPC stated that these inquiries are part of the company’s broader compliance issues.
The Irish regulator’s decision underscores the stringent enforcement of GDPR, particularly for tech giants like Google, which operate significant EU operations in Ireland.
The fine is a significant blow to Google’s European operations and highlights the importance of adhering to stringent data protection regulations.
