Irish DPC fines Google €403 million for unlawful location data processing

Original title: The Irish Data Protection Commission fines Google 403 000 000 EUR following Inquiry into Google’s processing of location data

The Irish Data Protection Commission (DPC) has issued a final decision imposing administrative fines totalling €403 million on Google Ireland Limited following an inquiry into the company's processing of location data. The DPC found that Google violated GDPR requirements regarding the lawfulness and fairness of processing in Web & App Activity and Location History, failed to meet accountability obligations for Location Accuracy, and breached transparency requirements across all three features. Organizations must review their own location data processing practices to ensure compliance with GDPR transparency, lawfulness, and accountability principles, particularly regarding user consent and data retention policies.

What changed

• Google Ireland Limited was found to have violated Article 5 (lawfulness and fairness principles) and Article 6 (lawfulness of processing) concerning the processing of location data in Web & App Activity and Location History features between 25 May 2018 and 4 February 2020.
• The company failed to meet accountability obligations under GDPR by not being able to demonstrate compliance with lawfulness, fairness, and transparency principles regarding Location Accuracy feature processing.
• Google violated transparency obligations under Articles 12 and 13 across all three location data features (Web & App Activity, Location History, and Location Accuracy).
• The company's retention practices for location data in Web & App Activity and Location History were found to be non-compliant with GDPR requirements.
• The DPC issued a compliance order requiring Google to bring its location data processing into full GDPR compliance.

Who is affected

Google Ireland Limited (technology sector). The decision potentially affects all organizations processing location data, requiring them to review their transparency and consent mechanisms for location-based services.

Summary generated by a language model; the official text prevails. Not legal advice.