Google hit with €403m fine by Irish data watchdog over GDPR violations
The penalty follows an inquiry launched into the tech giant six years ago, following complaints from several European consumer rights organisations.
Google has been fined €403m (£345m) by the Republic of Ireland's Data Protection Commission (DPC) over how it handled location data.
The penalty, one of the largest of its kind handed down by the Irish watchdog authority, came after an inquiry that was opened into the tech giant six years ago following complaints from several European consumer rights organisations.
On Monday, the DPC said its investigation found that Google had processed data in a way that was not "lawful", "fair" or "transparent".
The probe focused on Google's handling of location data in three specific features — Web & App Activity, Location History and Location Accuracy — between 25 May 2018 and 4 February 2020.
Location data is any type of data that can be used to infer a person's location.
It can "reveal a significant amount of information about an individual, including information that is inherently private", DPC deputy commissioner Graham Doyle said in a statement released on Monday.
The report said Google's practices "infringed" General Data Protection Regulation (GDPR) — legislation that took effect on 25 May 2018 and created strict data privacy and security law across the European Union (EU).
Doyle added: "The GDPR (General Data Protection Regulation) provides a high level of protection of personal data throughout the EEA (European Economic Area), and requires that the processing of personal data must be carried out in a lawful, fair and transparent manner."
He continued: "As a result of Google's failures... individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data.
"The retention of users' location data for longer than necessary aggravated this loss of control."
Along with the fine, Google has been ordered to bring its data processing into compliance within six months.
In a statement, Google said: "This case centres around historical policies that have since been updated. From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple."
It also said it has introduced data protection improvements in recent years, including "industry-first auto-delete controls", which enable all users to "set your account to automatically delete your data on a rolling three, 18, or 36-month basis".
Other measures to protect personal data have also been added, it said, such as "simple ads management", which allows you "to turn off personalized ads entirely", and "increased transparency", including "consolidated detailed information about our location data practices and account settings".