Irish regulator hits Google with €403m GDPR fine over invasive location tracking

Google has been slapped with a €403m fine by the Data Protection Commission (DPC) in Ireland on Monday (21 September) over breaches of EU data protection law (GDPR). But consumer groups said Irish authorities have been too slow to act, in a decision that took over six years after initial complaints about improper processing of sensitive data were submitted. The decision by the Irish privacy watchdog found that between May 2018 and February 2020, Google broke GDPR rules by storing location data longer than necessary and using it to disclose ads. The DPC said unlawful data processing for account features such as Location Accuracy took place, as well as improper retention of location data in Web & App Activity and Location History. For all three Google account features, the tech company failed to be sufficiently transparent with users, the DPC said. Graham Doyle, deputy commissioner at the DPC, shared that as a result of Google’s failures, “individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data.” “The retention of users’ location data for longer than necessary aggravated this loss of control”. “Location data can bring both benefits and harms to individuals. It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private. “The GDPR provides a high level of protection of personal data throughout the EEA [European Economic Area], and requires that the processing of personal data must be carried out in a lawful, fair and transparent manner.