Google has been fined €403 million (£345 million) by Ireland’s Data Protection Commission (DPC) over its handling of users’ location data.
A BBC report said the penalty followed an investigation that commenced six years ago after complaints from several European consumer rights organisations.
According to the BBC, the DPC said on Monday that its investigation found Google had processed location data in a manner that was not lawful, fair or transparent.
The inquiry examined Google’s processing of location data through three features — Web & App Activity, Location History and Location Accuracy — between 25 May 2018 and 4 February 2020.
The DPC said location data could reveal significant information about individuals, including information considered inherently private.
Graham Doyle, DPC Deputy Commissioner, said the General Data Protection Regulation (GDPR) required personal data to be processed lawfully, fairly and transparently.
He said Google’s practices infringed the GDPR, which came into effect on 25 May 2018 and established strict data privacy and security requirements across the European Economic Area.
According to Doyle, Google’s failures could have left individuals unaware that their location data was being used for purposes such as influencing advertisements or inferring their interests.
He added that retaining users’ location data for longer than necessary could further undermine their control over personal information.
The DPC also ordered Google to bring its data processing practices into compliance with the GDPR within six months.
Responding to the decision, Google said the case concerned historical policies that had since been updated.
“From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple,” the tech giant said.
Google said it had introduced several data protection measures, including automatic deletion controls that allow users to set their accounts to delete data on a rolling three-, 18- or 36-month basis.
The company also cited measures including simplified advertising controls, which allow users to turn off personalised advertisements, as well as increased transparency around its location data practices and account settings.
