Google has been fined €403 million by the Data Protection Commission (DPC) for violating the General Data Protection Regulation (GDPR). The sanctions stem from the way the technology company managed and processed the location data of its users.
According to Graham Doyle, Deputy Commissioner of the DPC, the infringements may have resulted in individuals being unaware that their movements were being tracked in order to determine their interests or to show them targeted advertisements.
Doyle said: “Location data is a type of personal data which is processed by way of location tracking, and includes data collected or processed by Google, which by itself or in conjunction with other information an individual’s location can be inferred. Location data can bring both benefits and harms to individuals. It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private.
“The GDPR provides a high level of protection of personal data throughout the EEA, and requires that the processing of personal data must be carried out in a lawful, fair and transparent manner. As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data. The retention of users’ location data for longer than necessary aggravated this loss of control”.
The investigation, which was launched in 2020, showed that Google did not comply with the GDPR standards on fairness, lawfulness and transparency. The regulator found in particular that three separate functions within the Google ecosystem were processing location data unlawfully.
Doyle clarified that location data includes all information collected through tracking that can be used to determine a person’s position, either on its own or in combination with other data.
The fine is one of the most significant measures ever taken by the DPC and ranks as the fourth-highest penalty imposed since the introduction of the General Data Protection Regulation.
Google has been given six months to bring its processing into compliance.
Business AM
Ltd
