Google fined 403 million euros in Europe inflicted by the Irish Data Protection Authority for infringements related to the processing of geolocation data. The decision refers to practices applied between May 2018 and February 2020 in several Google services and also requires the company to comply with them within six months.
A fine after several violations by Google
The Data Protection Commission (DPC), which acts as Google’s main supervisory authority in Europe, opened its investigation in February 2020 after receiving complaints from several European consumer organisations, including the European Consumer Organization (BEUC). The surveys focused on three functions: “Web and app activity”, “Rental history” and “Location accuracy”, during the period between the GDPR coming into force on May 25, 2018 and February 4, 2020.
The DPC accuses Google of several violations of the GDPR. The authority considers, in particular, that the processing of data in “Web and App Activity” and “Location History” did not sufficiently respect the principles of legality and fairness, while Google could not demonstrate its compliance regarding the transparency of “location accuracy”. The regulator also points out the lack of transparency in relation to the three functions and the excessively long retention of certain location data.
For Graham Doyle, Deputy Commissioner for Data Protection, these practices could lead some users to not be aware that their location data is used, in particular, to influence them with advertising or to deduce some of their interests. He also believes that retaining data longer than necessary has reduced users’ control over their personal information.
Google highlights the changes made since 2019
In response to the €403 million fine, Google says the decision concerns “historical policies that have since been updated”. The company highlights that its practices have evolved significantly since 2019 and that it has since implemented tools aimed at simplifying the management of location data.
Google in particular cites its automatic data deletion functions that allow you to configure the deletion of information based on a consecutive period of three, 18 or 36 months. Google also highlights simplified management of personalized ads, with the ability to completely disable your personalization, as well as more detailed and consolidated information about your location data practices and account settings.
The DPC orders Google to bring its processing operations in line with the GDPR within six months. The full final decision will be published later by the authority, while the amount of the fine is added to the sanctions already imposed by the Irish regulator on large technology companies under the GDPR.
