Investigation into Data Practices

The Irish Data Protection Commission (DPC), which serves as the primary regulator for Google within the European Union, recently concluded a long-running inquiry that started investigating the location data handling in 2020. The probe examined whether the company adhered to the General Data Protection Regulation (GDPR) during the period between May 2018 and February 2020. Regulators scrutinized three core features: Web & App Activity, Location History, and the Android-based Location Accuracy tool.

Findings on GDPR Non-Compliance

According to the official findings reported by SecurityWeek, the DPC determined that Google failed to process location data in a manner that was either lawful or fair. While the investigation spanned several years, the regulator highlighted that the company did not meet the necessary transparency requirements when processing personal data. Furthermore, the DPC noted that Google held onto user information collected through Web & App Activity and Location History for durations exceeding what was strictly necessary for its services.

Deputy Commissioner Graham Doyle emphasized the dual nature of location tracking, noting that while it can improve service utility, it poses inherent risks to individual privacy. By failing to maintain transparency, users were often left unaware that their movements were being tracked to infer interests or influence advertising exposure. This lack of clear disclosure contributed to what the regulator described as an unacceptable loss of control over personal information for users of Google services.

Google’s Response and Remediation

In response to the fine, Google issued a statement asserting that the issues identified by the regulator concern historical policies that have since been significantly updated. A company spokesperson noted that from 2019 onward, Google evolved its internal practices and introduced robust tools designed to make the management of location data more straightforward for its users. The company has since implemented specific controls allowing individuals to define timelines for the automatic deletion of their data.

As part of its ongoing adjustments, Google has centralized certain data storage, such as the Google Maps Timeline, directly on user devices to bolster privacy. The tech giant is now under a mandate to ensure all of its current data processing activities reach full compliance with EU regulations within the next six months. This decision is part of a broader regulatory landscape that has already seen the Irish watchdog hand out a hefty fine to other major technology platforms.

Context of EU Regulatory Action

The €403 million penalty marks the fourth largest privacy-related fine issued by the Irish DPC to date. The regulator continues to monitor the activities of various digital conglomerates, with three other active investigations currently involving Google at an advanced stage. The scrutiny faced by the company mirrors the intense pressure on other industry players, such as the record-breaking fine for Meta, which reached 1.2 billion euros, or the significant regulatory actions taken against other tech firms globally.

Sources

• SecurityWeekGoogle Hit With $463 Million Fine for EU Location Data Rule Breach
• BleepingComputerGoogle fined €403 million over location data privacy violations
• EngadgetGoogle fined $463 million for breaching EU location data rules