02.08.2024
2 min
1232
The Data Protection Commission (DPC) fined Google €403 million for unlawfully processing location data.
In February 2020, the Irish privacy and data protection regulator launched an investigation into how Google processed location data. The inquiry was prompted by complaints from several European consumer protection organizations.
Google collected and processed location data through three separate features: Web & App Activity, Location History, and Location Accuracy.
Through Web & App Activity, Google tracks what users search for and do across the company’s services and apps. Google also collects location data through this feature, which is enabled by default.
Location History tracks users’ movements while they are carrying a mobile device. The feature includes a timeline that allows users to see which places they have visited and what activities they performed. Unlike Web & App Activity, users must enable Location History themselves.
Location Accuracy is an Android feature that allows the operating system to determine a device’s location more precisely.
The Data Protection Commission (DPC) found that Google violated European privacy law through these features between May 2018, when the GDPR came into force, and February 2020, when the regulator launched its investigation.
As a result, Google must pay a €403 million fine. The company has also been ordered to bring its processing of location data into compliance with European data protection law within six months.
“Location data can bring both benefits and harms to individuals. It can significantly enhance the usefulness of online services, but it can also reveal a considerable amount of information about a person, including information that is inherently private,” Deputy Commissioner Graham Doyle said in a statement.
“Because of Google’s failures in this area, people may not have known that their location was being used, for example, to influence them through advertising or to determine their interests, and may have lost control over their personal data,” he continued.
Agustín Reyna, Director General of BEUC, said the decision was good news for consumers, but expressed regret that it had taken so long to reach this conclusion.
“Google tracked hundreds of millions of European consumers for years to learn as much about them as possible. Location data can be incredibly sensitive because it reveals a great deal about our private lives: where our children go to school, how many times someone has visited a hospital, or even a place of worship. This is incredibly intrusive, violates fundamental privacy rights and breaches the GDPR,” Reyna said.
A Google spokesperson told Reuters that the case concerns historical policies and that since 2019 the company has introduced robust tools and significantly improved its location data management practices.
Responding to questions, the Google spokesperson also said the company intends to appeal the fine in order to “obtain greater legal clarity on several specific issues.”
