Irish regulator fines Google $460M over location data processing
What's the story
Ireland's Data Protection Commission (DPC) has slapped a €403 million ($463 million) fine on Google. The penalty comes after an investigation into the tech giant's handling of location data. The DPC found that Google violated European Union privacy regulations, specifically the General Data Protection Regulation (GDPR), between 2018 and 2020 through three specific features: 'Web & App Activity,' 'Location History,' and 'Location Accuracy.'
Compliance mandate
Google directed to align with EU privacy rules
Along with the hefty fine, the DPC has also directed Google to align its data processing practices with EU privacy rules within six months.
The investigation was launched in 2020 after complaints from several European consumer rights organizations about Google's location data processing practices.
The DPC's Deputy Commissioner Graham Doyle said that due to Google's failures, individuals may have been unaware that their location was being used for targeted ads or inferring their interests.
Privacy risks
Concerns over retention of users' location data
Doyle also expressed concerns over the retention of users' location data for longer than necessary, which he said aggravated the loss of control.
The DPC's inquiry was prompted by a 2018 study from Norway's consumer agency that showed how location data could reveal personal information such as religious beliefs, political views, health issues, and sexual orientation.
Company statement
Google claims case revolves around historical policies
Responding to the DPC's ruling, a Google spokesperson said that the case revolves around historical policies that have since been updated.
They added that from 2019 onward, the company has significantly improved its practices and introduced robust tools for easy location data management.
The European Consumer Organisation (BEUC) based its complaint on research by Norway's Forbrukerradet which claimed Google used "various tricks" to ensure users enabled location history and web/app activity settings.
Enforcement critique
Norwegian Consumer Council welcomed ruling, BEUC criticized delayed enforcement
Finn Myrstad, director of digital policy at the Norwegian Consumer Council, welcomed the ruling.
He said today marks a significant milestone in protecting online rights and that people should understand what they're agreeing to without being manipulated into choices they wouldn't have made otherwise.
However, Agustin Reyna, director general of BEUC, criticized the delayed enforcement saying "the time needed to come to this conclusion is disproportionate with the seriousness of the infringement."