Irisih privacy watchdog fines Google $463M over location data breaches

The Irish Data Protection Commission (DPC) fined Google €403 million ($463 million) for violating the EU's General Data Protection Regulation (GDPR) rules regarding the processing of users' location data.

The commission announced its final decision on Monday following an inquiry into the processing of location data by Google Ireland Limited.

The Irish regulator launched the own-volition inquiry in February 2020 after receiving complaints from several European consumer rights organizations regarding the tech giant's location data processing.

The investigation focused on how Google processed location data in three specific features, namely Web & App Activity, Location History and Location Accuracy, between May 2018 and February 2020.

The commission found that Google infringed the GDPR regarding the lawfulness and fairness of its data processing and its accountability obligations.

The decision also stated that the company violated transparency obligations across all three features and retained user location data longer than necessary.

The commission imposed administrative fines totaling €403 million and ordered Google to bring its data processing practices into compliance within six months.

Data Protection Commission Deputy Commissioner Graham Doyle stated that location data can reveal inherently private information about an individual and warned that users could lose control over their personal data.

Doyle added that the retention of user location data for longer periods aggravated this loss of control.