Irish DPC Fines Google 403 Million Euros Over GDPR Location Data Violations

The Irish Data Protection Commission (DPC) has fined Google 403 million euros, approximately 463 million dollars, for violations of European privacy regulations under the GDPR. Google has also been ordered to align its location data processing methods with EU rules within six months.

Investigation and Key Features

Opened in 2020 following complaints from consumer rights organizations, the investigation focused on how Google handled location data between May 2018 and February 2020. Because Google's European headquarters is located in Dublin, the Irish regulator serves as the primary supervisory body for the company within the European Union.

At the center of the investigation were three specific features:

• Web & App Activity: stores user activity across various Google services.

• Location History: an optional feature creating a timeline of places visited by the user.

• Location Accuracy: designed to improve Android devices' ability to determine location beyond GPS alone.

According to the DPC, Google failed to process location data fairly and lawfully under Web & App Activity and Location History. The regulator also found shortcomings regarding transparency, fairness, and lawfulness principles for Location Accuracy.

Google's Response and Regulatory Context

Google stated that the findings pertain to outdated practices that have since been modified. "This case focuses on historical practices that have since been updated," the company said, noting significant changes made since 2019 to help users manage location data.

"This case focuses on historical practices that have since been updated." — Google representative

This penalty adds to a growing list of regulatory hurdles for Google in Europe. According to the DPC, it marks the fourth-highest fine imposed by the regulator since the GDPR took effect, while three additional major investigations into Google remain ongoing.