Hardware Ready Ready to Bench?
The Irish Data Protection Commission (DPC) has sanctioned Google with a total fine of 403 million euros following violations of the General Data Protection Regulation (GDPR) related to the processing of user location data.
The investigation, launched in February 2020 in response to complaints filed by European consumer rights organizations, including BEUC, covered the period between May 25, 2018 – the date of GDPR application – and February 4, 2020. The DPC ordered Google to align its processing methods with the GDPR within six months.
Google GDPR fine: why it matters
The investigative proceedings focused on three specific features: Web & App Activity, Location History, and Location Accuracy. The ruling establishes that Google violated the GDPR in several respects. In particular, regarding Web & App Activity and Location History, the DPC found irregularities concerning the lawfulness and fairness of location data processing.
The Irish authority also contested Google’s failure to meet accountability obligations regarding Location Accuracy, highlighting the company’s inability to demonstrate compliance with the principles of lawfulness, fairness, and transparency. Further allegations concern the transparency obligations applicable to all three features, as well as the retention periods for location data, which were deemed excessive in the case of Web & App Activity and Location History.
The DPC emphasizes that location-related data constitutes a particular category of personal information, as it can allow for the reconstruction of an individual’s movements, either directly or by combining it with other data. This information can enhance the utility of online services but may also reveal potentially very private aspects of users’ lives.
What changes and what are the effects
The GDPR requires that personal data processing be lawful, fair, and transparent within the European Economic Area. According to the DPC, the deficiencies found in Google’s case could have led to a lack of user awareness regarding the use of their location data, even for purposes such as influence through advertising or inference of their interests.
A Google spokesperson stated that the case concerns previous policies, updated from 2019 onwards, and that significant improvements have been introduced to procedures and tools for managing location data.
Source and further reading on Google GDPR fine: original article.
* Content created with the assistance of artificial intelligence systems.