The Data Protection Commission (DPC), Ireland's data protection authority, announced on Monday a fine of €403 million against Google Ireland Limited over failures in the way it processed users' location data. The decision closes an inquiry opened in February 2020 and gives the company six months to bring its practices into line.
The inquiry covered the period from 25 May 2018 — the day the General Data Protection Regulation (GDPR) took effect across the European Union — to 4 February 2020. According to the DPC, it was launched after complaints from European consumer rights groups, among them BEUC.
The three features under scrutiny
The decision concerns three features through which Google's systems collect and use the location of people who use its services: Web & App Activity, Location History and Location Accuracy.
The authority found that the company had breached GDPR obligations on four fronts:
- lawfulness and fairness of processing (Articles 5 and 6) — using the data without an adequate legal basis;
- accountability (Article 5(2)), the duty to demonstrate compliance;
- transparency (Articles 13 and 14), the information users should have been given about what was collected and why;
- storage limitation (Article 5(1)(e)), keeping the data for longer than necessary.
"Location data can reveal significant information about individuals, including inherently private details," Deputy Commissioner Graham Doyle said in the DPC's statement. Google's failures, he said, meant users could be unaware that their location was being used, for example, to influence them with ads or to infer their interests.
Fine and order to comply
Alongside the €403 million, the DPC ordered the company to bring its processing into compliance within six months. The amount sits well below the ceiling set by the GDPR itself, which allows fines of up to 4% of a group's total worldwide annual turnover.
Why the decision comes from Dublin
The DPC handles the case because Google's European headquarters is in Ireland. Under the GDPR's "one-stop-shop" mechanism, the authority in the country where a company has its main establishment in the bloc leads the inquiry and decides, working with the others. In its statement, the DPC thanked its peer supervisory authorities across the European Union for "the cooperation and assistance" they provided.
It is the same design that makes Ireland the address of Europe's biggest decisions against digital platforms: because the large technology companies base their regional headquarters there, the Irish regulator is the one that, in practice, imposes a good share of the bloc's penalties.
With information from the Data Protection Commission (Ireland) and Euronews.
