The European Union’s personal data regulatory authority has fined Google €403 million for processing users’ location data in violation of EU rules.
Ireland’s Data Protection Commission (DPC), which serves as the authority responsible for personal data protection in the EU, has published its final decision in its investigation into Google Ireland Limited.
The fine, covering the period from May 25, 2018 to February 4, 2020, was issued following complaints from various European consumer rights organizations. Google was penalized for its failure to demonstrate the lawfulness and fairness of location data processing in “web app activity” and “location history,” its failure to comply with the principles of lawfulness, fairness, and transparency regarding the processing of personal data in “location accuracy,” and its transparency obligations across all three of these features.
The Irish DPC has ordered Google to bring its data processing activities into compliance with the law within six months.
As Google’s European headquarters is based in Ireland, the Irish DPC serves as the company’s lead supervisory authority for personal data processing activities across the EU.
