Google fined more than €400m by Irish regulator over its use of location data

Google has been fined more than €400m (£345m) over the way it processed users’ location data, following claims that the tech giant had manipulated users into agreeing to be constantly tracked on their mobile phones.The fine, imposed by Ireland’s Data Protection Commission (DPC), comes after complaints from multiple European consumer organisations that Google was following every step users took.Location-related adverts are familiar to holidaymakers, but seven European consumer organisations had complained that undue use of location data can also lead to a breach of privacy.The DPC inquiry was prompted by research by the Norwegian consumer agency in 2018 which suggested location data could reveal details such as religious beliefs (by tracking places of worship), political leanings (for example knowing a user has gone to demonstrations), health conditions (if a user has gone to hospital) and sexual orientation (if they have gone to certain bars).The DPC launched its inquiry six years ago and set out to find out whether Google had a valid legal basis for its use of location data.It found that Google users could have been unaware that their location was being used to influence them with adverts or to gather details about their health and interests.“location data is a type of personal data which is processed by way of location tracking, and includes data collected or processed by Google, which by itself or in conjunction with other information an individual’s location can be inferred,” said Graham Doyle, a deputy commissioner at the DPC.“location data can bring both benefits and harms to individuals.“It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private,” Doyle added.Responding to the DPC’s ruling, a Google spokeperson said: “This case centres around historical policies that have since been updated. From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple.”The European Consumer Organisation (BEUC) based its complaint on research by the Forbrukerrådet, the Norwegian consumer agency, which claimed Google used “various tricks” to ensure location history and web and app activity were enabled.“Today marks an important milestone in the effort to protect our rights online. People must be able to understand what they are agreeing to without being deceived or manipulated into making choices they otherwise would never have made,” says Finn Myrstad, director of digital policy at the Norwegian Consumer Council.BEUC said that geolocation data was “one of the most invasive forms of consumer surveillance”.Agustín Reyna, director general of BEUC, welcomed the ruling but said “the time needed to come to this conclusion is disproportionate with the seriousness of the infringement” arguing “late enforcement can be as harmful as no enforcement at all”.The DPC inquiry looked at “web and app activity”, “location history” and “location accuracy” between 25 May 2018 and 4 February 2020.skip past newsletter promotionafter newsletter promotionImposing a fine of €403m, the DPC ordered Google to bring its processing into compliance with the EU’s general data protection regulation (GDPR) within six months.It is the fourth-largest fine imposed by the Irish regulator, which has EU-wide responsibility for all the US tech giants with EU headquarters in Ireland.It has previously fined Meta €1.2bn, TikTok €530m and Instagram (also Meta owned) €405m.Doyle said: “The GDPR provides a high level of protection of personal data throughout the EEA, and requires that the processing of personal data must be carried out in a lawful, fair and transparent manner.“As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data.“The retention of users’ location data for longer than necessary aggravated this loss of control,” added Doyle.There are three other ongoing statutory large-scale inquiries open that concern Google, all of which are at an advanced stage.