The Irish Data Protection Commission (DPC) has fined Google €403 million, following an inquiry it launched in February 2020 in its capacity as the Lead Supervisory Authority for Google. The inquiry followed complaints from several European consumer rights organisations regarding Google’s processing of location data related to certain services and products.
The inquiry concerned Google’s processing of location data in three specific features – “Web and App Activity”, “Location History” and “Location Accuracy” from when the GDPR came into force on 25 May 2018 until 4 February 2020.
Google uses “Web & App Activity” to process information related to users’ activity on Google services and can include personal data such as browsing history, search history and location data. “Location History” keeps track of users’ locations while in possession of their mobile devices. Users must opt in to this feature which processes each users’ data to infer information such as place visits, activities and paths between place visits. Google History saves where the users go with their signed-in devices, even when the user is not using a Google service. “Location Accuracy” is part of Android OS allowing a device to determine its location with greater accuracy than simply relying on inputs from the device’s GPS unit and is available to Android users whether they are Google Account holders or not.
The decision finds that Google infringed the GDPR in respect of
- the lawfulness and fairness of its processing of location data in Web & App Activity and Location History;
- its accountability obligations under the GDPR by failing to demonstrate compliance with lawfulness, fairness and transparency principle regarding processing of personal data in Location Accuracy;
- its transparency obligation in respect of all three features; and
- its retention of location data in Web & App Activity and Location History.
The DPC has imposed fines totalling €403 million and has ordered Google to comply with the GDPR within six months.
