Google has been fined €403 million by Ireland’s Data Protection Commission over the way it processed users’ location data, in one of the largest privacy penalties imposed by the regulator.
The DPC says Google breached the European Union’s General Data Protection Regulation between May 2018 and February 2020. The investigation examined how Google collected and used location information through Web & App Activity, Location History and Location Accuracy.
According to the regulator, Google failed to give users enough clarity about how it processed their location data. The company also kept some location information longer than necessary, the DPC found.
The regulator also raised concerns about how Google could use location data to infer users’ interests and influence the advertisements they saw. It said users may not have fully understood how the company processed their information or the choices available to them.
European consumer organisations filed complaints that helped trigger the investigation in February 2020.
The DPC has now ordered Google to change its practices and comply with GDPR requirements within six months. The regulator says the case highlights the need for technology companies to give users clear information about how they collect, use and retain personal data.
Location information can reveal where people live, work, travel and spend their time, making it particularly sensitive for privacy.
Google has defended its current practices and says it made significant changes to its approach from 2019 onward.
The DPC will publish its full decision in due course.
