Sign in

Irish Data Protection Commission fines Google EUR 403 million for unlawful location data processing

Original title: The Irish Data Protection Commission fines Google EUR 403 000 000 following Inquiry into Google’s processing of location data

Info Other, enforcement EU

The Irish Data Protection Commission issued a final decision fining Google EUR 403 million for breaching GDPR requirements in processing location data through three specific features. Google violated lawfulness, fairness, transparency, and accountability principles, and failed to comply with retention obligations between May 2018 and February 2020. Organizations must ensure lawful basis and transparent consent mechanisms for location data collection, demonstrate accountability through clear compliance documentation, and implement appropriate data retention policies aligned with processing purposes.

What changed

  • Irish DPC found Google breached Article 5 GDPR (principles relating to processing of personal data) by processing location data in Web & App Activity and Location History in an unlawful and unfair manner
  • Google violated Article 6 GDPR (lawfulness of processing) and failed to demonstrate compliance with lawfulness, fairness and transparency principles for Location Accuracy feature
  • Google infringed transparency obligations under Article 12 and 13 GDPR by failing to provide clear and sufficient information about location data processing to data subjects
  • Google retained location data in Web & App Activity and Location History longer than necessary, violating data minimization and storage limitation principles
  • Administrative fine of EUR 403 million imposed with compliance order requiring Google to bring processing into compliance within 6 months

Who is affected

Technology companies processing location data in EU; any organization collecting location information through similar features or services; particularly entities providing web services, mobile apps, and location-based features subject to GDPR

Summary generated by a language model; the official text prevails. Not legal advice.

More changes in GDPR