The investigation dates back to 2020.
Adarsh Chauhan/Unsplash
Google has been handed a hefty fine for breaching European Union privacy rules over its handling of location data. The company will have to pay €403 million ($463 million) and make its location data processing compliant with the General Data Protection Regulation (GDPR) within six months.
Ireland’s Data Protection Commission (DPC), the main regulator for the company in the EU since Google’s European HQ is in Dublin, started investigating the location data handling in 2020 following complaints from consumer rights groups. The DPC looked at how Google dealt with location data between May 2018 and February 2020 regarding three features: Web & App Activity (which saves users’ activity across a slew of Google services), Location History (an opt-in feature that shows a timeline of where users have been with their phone) and Location Accuracy (which pinpoints where an Android device is with more accuracy than GPS alone).
The DPC determined Google didn’t fairly or lawfully process location data in Web & App Activity and Location History. It failed to show that it complied with the GDPR’s “lawfulness, fairness and transparency principle” in terms of processing data in the Location Accuracy feature, according to the regulator.
The DPC claimed the company failed to meet transparency rules for all three of those features. It added that Google violated GDPR location data retention rules in Web & App Activity and Location History.
“This case centers around historical policies that have since been updated,” Google told the Associated Press in a statement. “From 2019 onwards, we’ve significantly evolved our practices and launched robust tools that make managing location data simple.”
This is hardly the first time Google has been in hot water in the EU. This summer, the company lost its final appeal over a $4.7 billion Android antitrust fine that the bloc imposed in 2018.
The European Commission also fined Google $1 billion in July after determining it unfairly prioritized its own services in Search results. The company this month agreed to make some changes to Search to reduce the fine. The DPC said there are “three other ongoing statutory large-scale inquiries open that concern Google, all of which are at an advanced stage.
The regulator said this is the fourth largest fine it’s dished out since the GDPR came into effect. The largest of those was a $1.3 billion fine it gave Meta for transferring EU citizens’ Facebook data to servers in the US.