Google Fined €403 Million by Ireland for Location Data Breach

Ireland's Data Protection Commission (DPC) fined Google 403 million euros (about $462 million) on Monday for improperly using users' location data.

The fine requires court approval before it can be collected. The DPC, Google's lead privacy regulator in Europe, also gave Google's Irish subsidiary six months to bring its handling of location data into compliance with EU law. The inquiry examined Google's practices from May 25, 2018, when the EU's General Data Protection Regulation (GDPR) went into effect, through February 4, 2020.

The DPC found Google handled location data unlawfully and unfairly through Web & App Activity and Location History, kept it too long, and failed to explain its practices clearly enough. For Location Accuracy, Google failed to demonstrate lawful, fair, and transparent data handling, and users were not adequately informed. Graham Doyle, DPC deputy commissioner, stated that location data can reveal inherently private information.

Seven consumer organizations, coordinated by the European Consumer Organisation (BEUC), filed complaints in November 2018. A Danish group separately reported the practices to its national authority. The DPC opened its inquiry in February 2020. This is the fourth largest EU privacy fine issued by the Irish watchdog, which has previously fined TikTok and Meta, including a 1.2 billion euro fine for Meta.

The GDPR was designed to give people more control over their personal information and set limits on how companies collect, use, and keep it. Google's European headquarters is based in Dublin, making Ireland the lead regulator for Google in the 27-nation EU. Google stated, "This case centers around historical policies that have since been updated," adding, "From 2019 onwards, we've evolved our practices and launched robust tools that make managing location data simple." The DPC still has three other ongoing privacy investigations involving Google, all at an advanced stage.