Ireland fines Google 403 million for the management of geolocation data
The Data Protection Commission believes that the company violated EU rules between May 2018 and February 2020
LondonThe Data Protection Commission (DPC) of the Republic of Ireland has imposed a 403 million euro fine on Google Ireland Limited for infringing the European Union's (EU) General Data Protection Regulation (GDPR) in the processing of its users' geolocation information. The penalty, one of the highest imposed to date by the Irish authority, is the result of an investigation initiated in February 2020 following several complaints filed by consumer protection organizations.
The investigation analyzed data processing between May 25, 2018 –the date the so-called GDPR came into force– and February 4, 2020, and focused on three Google service functions: web and app activity, location history, and location accuracy.
In the case of web and app activity and location history, the supervisory body considers that the processing was not sufficiently justified nor transparent enough. Regarding location accuracy, Google could not demonstrate that it complied with GDPR principles throughout the period under investigation. The DPC also considered the time during which certain data was retained to be inadequate.
Location data, if enabled, can allow for the reconstruction of very intimate aspects of a person's life. According to Graham Doyle, Deputy Commissioner of the DPC, the detected shortcomings could mean users were unaware that their location could be used, for example, for advertising purposes or to infer their interests. The retention of data for longer than necessary, according to the authority, exacerbated this loss of control.
The gateway for tech companies
The DPC began the investigation after receiving complaints from various European consumer organizations, among which was the European Consumer Organisation (BEUC), which brings together 44 such entities. Ireland, moreover, acts as the lead supervisory authority for Google and other tech companies in the EU, within the framework of the cooperation system established by the GDPR. This function makes the Irish body an especially relevant regulator, as many large US companies have their legal domiciles in the republic. The decisions of the Irish authority are subject to the cooperation mechanism with the other national data protection authorities of the Union.
In addition to the fine, the DPC has ordered Google to adapt its processing of location data to comply with the GDPR within a period of six months. The resolution adds to a long series of sanctioning proceedings by the DPC. Since the entry into force of the GDPR, the Irish body has imposed more than 4 billion euros in fines, although only a much smaller portion has been collected. The fines can be appealed or must be confirmed judicially.
Google has argued that the resolution refers to practices that belong to the past. The company asserts that it has introduced changes since 2019, including options for automatic data deletion, simpler tools to manage personalized advertising, and more information for users about how their data is processed. It also states that it currently stores less precise location data.
The DPC's decision comes more than six years after the entry into force of the GDPR and focuses on one of the personal data points that allow for a more detailed image of an individual's habits: knowing where they are—and where they have been—can reveal everything from their workplace and home address to visits to certain establishments or habitual commutes. The DPC considers that this inference capability makes it especially important for the user to know what information is collected, for what purpose, and for how long it is kept.
In the past, European fines against United States technology companies have sparked no shortage of criticism from the White House. Donald Trump has an obsession against regulation in the European Union's digital sector. Since returning to the White House, he insists that he sees it as a direct attack on large American tech companies, which make a fortune in the community market, and demands that European leaders lower the regulations on competition and transparency that affect the tech giants. At the end of last year, Trump threatened to restart the tariff war against all allies that, like the European Union, regulated the digital sector and applied fines against large tech companies that violated the law. The fine comes at a time when the limits of AI are also being discussed.