Google faces €403 million GDPR fine over location data

Google has been hit with another legal setback in which the tech giant is ordered to pay more than 400 million euro in a penalty for violating GDPR (general data protection regulation.)

Ireland’s Data Protection Commission (DPC) launched an inquiry into Google Ireland in 2020 followed by complaints from multiple European consumer rights organizations about the company’s processing of location data.

Between May 2018 and February 2020, DPC investigated Google’s handling of user data, specifically focusing on web and app activity, location history, and location accuracy.

Throughout the inquiry process, the DPC assessed the lawfulness and fairness of location data processing and tech giant’s accountability under GDPR. However, Google failed to comply as per Irish inquiry.

DPC Deputy Commissioner Graham Doyle said in a statement, "As a result of Google's failures, individuals could have been unaware that their location was ​being used to, for example, influence them ​with ads or to infer their interests, and could lose ‌control ⁠over their personal data.”

"The retention of users' location data for longer than necessary ​aggravated this ​loss of ⁠control."

He added, "The GDPR provides a high level of protection of personal data throughout the EEA, and requires that the processing of personal data must be carried out in a lawful, fair and transparent manner.”

As a result, the DPC has issued administrative fines totalling 403 million euro and given Google six months to bring its data processing practices into compliance with the law. This marks the fourth largest fine ever levied by the DPC under GDPR regulations.