Google Ireland has six months to bring three of its location features into line with European data protection law after Ireland’s Data Protection Commission today imposed administrative penalties totalling €403 million, closing an inquiry it opened in February 2020 on the back of complaints from European consumer groups.
Ireland’s privacy regulator decided that Google broke Europe’s privacy rules in the way three features on Android phones and Google accounts handled people’s location between May 2018 and February 2020. The regulator said people may not have realised their location was being used to show them ads or to guess their interests, and that some of that information was kept longer than necessary.
The DPC sets out its final decision on four counts:
- Lawfulness and fairness infringements in Web & App Activity and Location History
- Accountability infringement in Location Accuracy
- Transparency infringements across all three features
- Retention infringements in Web & App Activity and Location History
The DPC imposed administrative fines totalling €403 million and ordered Google to bring its processing into compliance within six months. The full decision has not yet been published, and no breakdown of the penalty by infringement has been given.
Earlier Irish decisions of this kind have ended up in court. Google has indicated it may appeal.
The inquiry opened in February 2020 and covered processing between 25 May 2018 and 4 February 2020.