Google ordered to pay 403 million euro GDPR fine for location data violations

Investigation timeline and scope

The regulator launched an inquiry into Google Ireland in 2020 following complaints from European consumer rights organizations. Between May 2018 and February 2020, the commission examined web activity, app usage, location history, and location accuracy. The investigation assessed whether the tech giant met its accountability requirements under the General Data Protection Regulation.

Findings on data handling

DPC Deputy Commissioner Graham Doyle stated that Google failed to comply with Irish data protection requirements during the inquiry process. He noted that individuals could have been unaware their location was used to influence them with ads or infer their interests. Keeping user location data for longer than necessary aggravated this loss of control over personal information.

Regulatory statement on compliance

The commission requires that processing personal data must be carried out in a lawful, fair and transparent manner throughout the EEA. Google's failures meant users lost control over their personal data while the company retained information beyond necessary periods.