Irish regulator fines Google €403 million over location data — Asharq Al-Awsat
Ireland’s Data Protection Commission (DPC), which supervises Google at the European level because the company’s headquarters are located in Ireland, has fined the company €403 million for improper use of users’ location data. As Asharq Al-Awsat reports, the violations concerned the period from May 2018 to February 2020.
GDPR violations
The regulator concluded that Google violated the requirements of the EU General Data Protection Regulation (GDPR) concerning the lawfulness and fairness of processing location data in the Web & App Activity and Location History services.
DPC Deputy Commissioner Graham Doyle stated that shortcomings in the company’s approaches meant users might not have been aware that their location data was being used, including to influence them through advertising or determine their interests. According to him, the situation was compounded by the retention of location data for longer than necessary.
The fine became the fourth-largest in the DPC’s history. The regulator also ordered Google to bring its data processing into compliance with the GDPR within six months.
More current news is available on the UA.News Telegram channel Telegram.
Reaction from Google and consumer organisations
Google said the case concerned historical policies that the company had already updated. The corporation noted that since 2019 it had significantly changed its practices and launched tools for easier management of location data.
The DPC received coordinated complaints against Google in November 2018 from consumer organisations in the Czech Republic, Denmark, Greece, the Netherlands, Norway, Poland, Slovenia and Sweden. The European Consumer Organisation BEUC welcomed the decision but criticised the length of the proceedings. The organisation described geolocation data as one of the most invasive forms of commercial surveillance, as it can reveal information about a person’s religious beliefs, health status, political views or sexual orientation.
The DPC is also conducting three more investigations into Google, which, according to the regulator, are at an advanced stage. One of them concerns a possible failure to carry out a data protection impact assessment when using Europeans’ personal data to train Google’s artificial intelligence.
