Google Fined €403 Million Over Location Data Collected From Users' Phones
Ireland's Data Protection Commission fined Google Ireland Limited €403 million on Sept. 21 and ordered the company to bring its handling of location data into compliance within six months, ending an inquiry the regulator opened in February 2020.
The data at issue is the record of where people have been while carrying their phones. The commission examined three Google features that collect or use it: Web & App Activity, Location History and Location Accuracy. The period it reviewed ran from May 25, 2018, when the European Union's data protection rules took effect, to Feb. 4, 2020.
In its announcement, the commission said Google processed location data in Web & App Activity and Location History without a lawful basis and unfairly. It also found that Google could not demonstrate compliance for Location Accuracy, fell short of its transparency obligations for all three features, and kept location data from the first two longer than necessary.
The commission described Web & App Activity as an account setting that covers what users do across Google services, including browsing and search history. It described Location History as an opt-in service that tracks a signed-in device and maps the places a user visits, and Location Accuracy as an Android feature that fixes a device's position more precisely than GPS alone, available to any Android user.
Deputy Commissioner Graham Doyle said location data can make online services more useful, but can also reveal "a significant amount of information about an individual, including information that is inherently private." He said Google's failures meant people could have been unaware that their location was being used to influence them with ads or to infer their interests.
In a statement to BleepingComputer, a Google spokesperson said the case "centers around historical policies that have since been updated," and that the company has since "significantly evolved" its practices and added tools for managing location data.
The commission said it will publish the full decision in due course. It opened the inquiry after complaints from several European consumer rights organizations, including BEUC.
