The Data Protection Commission (DPC) has fined Google €403 million following an inquiry into its processing of Google location data under three features: Web & App Activity, Location History and Location Accuracy. The inquiry examined location data processing between May 25, 2018, when the GDPR came into application, and February 4, 2020.
The DPC launched the own-volition inquiry in February 2020 after receiving complaints from several European consumer rights organisations, including BEUC. The DPC acted as the Lead Supervisory Authority for Google Ireland Limited.
Google Location Data Processing Under GDPR Review
The inquiry examined how Google processed location data through the three specified features and assessed whether the processing complied with requirements under the GDPR.
The DPC’s final decision found that Google infringed the GDPR in relation to the lawfulness and fairness of its processing of location data through Web & App Activity and Location History.
The regulator also found that Google failed to meet its accountability obligations regarding Location Accuracy. According to the decision, Google was unable to demonstrate compliance with the GDPR principles of lawfulness, fairness and transparency in its processing of personal data through the feature.
The DPC further identified transparency breaches across all three features.
Findings Cover Data Retention and Transparency
The Google GDPR fine also relates to the retention of location data. The DPC found issues with Google’s retention of location data through Web & App Activity and Location History.
The regulator said that location data is personal data that can allow an individual’s location to be inferred, either from the data itself or in combination with other information.
Deputy Commissioner Graham Doyle said location data can provide benefits by improving the utility of online services, but can also reveal significant information about individuals, including information that is inherently private.
The DPC said Google’s failures could have resulted in individuals being unaware that their location data was being used, including for purposes such as influencing them with advertisements or inferring their interests. It said this could result in individuals losing control over their personal data.
The regulator also said that retaining users’ location data for longer than necessary aggravated this loss of control.
What the Three Google Features Do
Web & App Activity is a Google Account setting available to Google Account holders. When enabled, it processes information related to activity on Google services, including websites and applications. This information can include browsing history, search history and location data.
Location History tracks a user’s location while they have a compatible mobile device. Users must opt in to the service. It can process data to infer information such as places visited, activities and routes between locations.
The feature also uses Google’s Timeline function, which displays a private map through Google Maps showing where users have travelled. The location information is saved for signed-in devices even when the user is not using a Google service.
Location Accuracy is an Android OS feature designed to determine a device’s location more accurately than relying only on GPS inputs. Unlike the other two features, it is available to Android users regardless of whether they have a Google Account.
Google Ordered to Change Processing
The DPC imposed administrative fines totalling €403 million and ordered Google to bring its processing into compliance within six months.
The decision was made by Data Protection Commissioners Dr Des Hogan, Dale Sunderland and Niamh Sweeney. The DPC also acknowledged the cooperation and assistance of its peer supervisory authorities during the inquiry.
The regulator said the full decision will be issued in due course.
