Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

Irish DPC fines Google €403 million for unlawful location data processing

Fine: €403 million

The Data Protection Commission (DPC) today imposed administrative fines totalling EUR 403 million on Google Ireland Limited, following an inquiry into its processing of location data. Google must now bring its processing practices into compliance within 6 months. This decision addresses infringements related to lawfulness, fairness, transparency, and accountability.

The DPC's inquiry, launched in February 2020, focused on Google's processing of location data within three specific features: Web & App Activity, Location History, and Location Accuracy. The period under scrutiny spanned from 25 May 2018 to 4 February 2020. The Commissioners for Data Protection, Dr Des Hogan, Mr Dale Sunderland and Ms Niamh Sweeney, found Google infringed the General Data Protection Regulation (GDPR) in several respects.

Specifically, the DPC determined Google infringed the lawfulness and fairness principles regarding its processing of location data in Web & App Activity and Location History. It also failed its accountability obligations by not demonstrating compliance with the lawfulness, fairness and transparency principle concerning Location Accuracy. Furthermore, Google infringed transparency obligations across all three features and its retention of location data in Web & App Activity and Location History. Deputy Commissioner Graham Doyle noted that individuals could have been unaware their location was used to influence advertisements or infer interests, leading to a loss of control over personal data, aggravated by longer than necessary retention.

The processing of location data by large online service providers remains a persistent regulatory focus, as evidenced by this EUR 403 million fine.

Data Protection Commission decision

Who this binds
Google Ireland Limited is legally bound by this decision under the General Data Protection Regulation in the European Economic Area.
What changed
Google Ireland Limited must now bring its processing of location data into compliance within 6 months, following the Data Protection Commission's decision.
What to watch
Organisations should monitor how Google implements the required compliance changes and the DPC's full decision for detailed insights into specific remediation steps.
What this does not mean
This decision does not mean that all processing of location data is prohibited, but rather that such processing must strictly adhere to GDPR principles of lawfulness, fairness, transparency, and accountability.

Not settled: The Data Protection Commission will issue the full decision in due course, which may provide further details on the specific findings and compliance requirements.

Send this to your team

The Irish Data Protection Commission fined Google Ireland Limited EUR 403 million and ordered it to bring its location data processing into compliance within 6 months, affecting all organisations processing similar data within the European Economic Area.

Today's question

The DPC imposed administrative fines on Google Ireland Limited for infringements related to its processing of location data. Which of the following GDPR principles did Google specifically infringe regarding its processing of location data in Web & App Activity and Location History?

  1. Lawfulness and fairness of processing
  2. Data minimisation and purpose limitation
  3. Integrity and confidentiality of processing
  4. Purpose limitation and data accuracy

Answer this question on the site

Worth knowing

  1. EDPB adopts guidelines on administrative fines and DSA-GDPR interplay

    Organisations operating in the EU should review the EDPB's new guidelines to understand the harmonised approach to administrative fines and the interaction between the DSA and GDPR, which will influence future enforcement actions.

  2. Canadian Privacy Commissioner investigates IDScan.net data breach involving stolen identification details

    Organisations using third party identity verification services should assess their vendors' security safeguards and breach response plans, as the Privacy Commissioner of Canada is investigating IDScan.net's compliance with PIPEDA.

  3. Experts alarmed over Gyazo's breach of 490 million metadata records

    Organisations handling large volumes of metadata should recognise that even seemingly innocuous data points can pose significant security and privacy risks when aggregated and exposed, as demonstrated by the Gyazo breach.

  4. EU KIDS Act proposal introduces new regulatory framework for children online

    Digital service providers targeting or accessible by children in the EU should prepare for new obligations under the proposed EU KIDS Act, including age assurance and safety by design requirements, which will have broad extraterritorial reach.

  5. The AI regulation smackdown isn’t over

    The Verge's commentary signals that the ongoing global legislative debate around AI governance means privacy professionals must anticipate evolving compliance obligations for AI systems.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.