Full Breakdown
Irish Regulator Imposes €403 Million Fine on Google for Location-Data Violations
By Drooid · · How we work
Background & Context
The Data Protection Commission (DPC) of Ireland, the lead EU supervisory authority for Google, opened an inquiry in February 2020 after complaints from European consumer-rights groups, including BEUC. The probe examined Google’s handling of location data through “Web & App Activity,” “Location History,” and “Location Accuracy” for the period May 25 2018 – February 4 2020.
Timeline
- May 25 2018 – February 4 2020 – Period examined.
- February 2020 – DPC launches its own-initiative inquiry.
- September 21 – DPC announces a €403 million fine and orders compliance within six months.
Data & Statistics
- Fine: €403 million (? $463 million).
- Compliance deadline: six months from the September 21 announcement.
- Fourth-largest Irish regulator penalty after Meta (€1.2 bn), TikTok (€530 m) and Instagram (€405 m).
Official Statements & Responses
- DPC Deputy Commissioner Graham Doyle said Google’s processing lacked lawful and transparent bases, leaving users unaware that their location was used to influence ads or infer interests, and that excessive data retention aggravated the loss of control.
- Google noted that from 2019 it introduced “robust tools” and auto-delete options for location data.
- BEUC welcomed the decision as a step forward for consumer rights.
Conflicting Reports & Gaps
- Fine amount: Most sources (Reuters, Irish Times, ANSA, The Next Web) list €403 million; a few (The Guardian, Investing.com) round it to “more than €400 million.”
- Remedial actions: The DPC’s compliance order does not detail the specific technical changes Google must make.
Verbatim Quotes
- “Location data is a type of personal data which is processed by way of location tracking, and includes data collected or processed by Google, which by itself or in conjunction with other information an individual’s location can be inferred,” — Graham Doyle, DPC deputy commissioner
- “It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private,” — Graham Doyle
- “The decision is good news for consumers, as it holds Google accountable and confirms the illegality of the way the tech giant obtained consent to use peoples’ location data,” — Agustín Reyna
What’s Next
The DPC has given Google six months to adjust its location-data processing to meet GDPR requirements. The regulator will monitor compliance and may impose further measures if the changes are not implemented within the stipulated period.