Google Fined €403 Million for GDPR Violations

Google has been issued a fine of €403 million by Ireland’s Data Protection Commission (DPC) for breaches of the General Data Protection Regulation (GDPR). The regulatory decision follows an extensive investigation into the methods the company employed to process user location data.

The fine is the culmination of a probe into Google Ireland that was initiated six years ago in response to formal complaints from European consumer rights organizations regarding location-sharing practices. In an official statement, the DPC explained that it scrutinized the lawfulness and fairness of Google's location data processing to determine if it aligned with GDPR standards. After analyzing web and app activity, location history, and data accuracy between May 2018 and February 2020, the DPC concluded that users may have been unaware that their location information was being used to infer their personal interests and influence them with targeted advertisements.

Deputy commissioner Graham Doyle said that while location data can greatly enhance the utility of online services, it can also reveal a significant amount of information about an individual, including inherently private information. He said that GDPR provides a high level of protection of personal data throughout Europe, and requires the processing of personal data to be carried out in a lawful, fair and transparent manner. This penalty represents the fourth-largest fine issued since the implementation of GDPR. To date, Meta Platforms remains the most heavily penalized entity, having faced a €1.2 billion fine for the transfer of personal data from the EU to the US.