Google has faced another legal setback after Ireland’s data protection regulator ordered the tech giant to pay a fine of more than 400 million euros for violating the General Data Protection Regulation (GDPR).
Ireland’s Data Protection Commission (DPC) launched an investigation into Google Ireland in 2020 after several European consumer rights organizations filed complaints about the company’s processing of location data.
Between May 2018 and February 2020, the DPC examined how Google handled user data, focusing on web and app activity, location history and the accuracy of location information.
During the investigation, the DPC examined whether Google’s processing of location data was lawful and fair and whether the company met its accountability requirements under the GDPR. However, the regulator found that Google had failed to comply with Irish data protection requirements.
DPC Deputy Commissioner Graham Doyle said in a statement that Google’s failures could have left people unaware that their location data was being used to influence them through advertising or to infer their interests. He said this could also have reduced users’ control over their personal data.
Doyle added that keeping users’ location data for longer than necessary made this loss of control more serious.
“The GDPR provides a high level of protection of personal data throughout the EEA, and requires that the processing of personal data must be carried out in a lawful, fair and transparent manner,” he said.
As a result, the DPC imposed administrative fines totaling 403 million euros and gave Google six months to bring its data processing practices into compliance with the law.
The penalty is the fourth-largest fine ever imposed by the DPC under the GDPR.
