The Ireland Data Protection Commission (DPC) has imposed a fine of €403 million ($463 million) on Google for a number of violations of the GDPR concerning the processing of users’ location data, the DPC said.
The investigation was initiated by the DPC in February 2020 following complaints from consumer rights organizations and looked at three Google features that were in operation during the GDPR period, which ran from May 25, 2018, to February 4, 2020.
The DPC concluded that Google had not fulfilled its transparency duties and had kept some location data for longer than was necessary. Google has now been given six months in which to bring its data processing into line with the requirements.
The company states that the case is concerned with policies that have been revised since then.
Google Location Features Examined and the GDPR Findings
The DPC looked at three features relating to permissions which allowed Google to handle users’ web and app activity, location history, and location accuracy data.
Web and App Activity is an option available to Google Account users which enables Google to handle activity from its various services, possibly involving browsing history, search history, and location data.
Location History is a service that must be explicitly agreed to by users and which tracks people using compatible mobile devices by working out where they have been, what they have been doing, and the routes they have taken, showing this information via a private Google Maps Timeline even if the user is not currently using any Google services.
Location Accuracy is a feature on Android that aids a device in determining its position more accurately than GPS alone and is available irrespective of whether the user has a Google Account.
The DPC has found that Google processed location data via Web & App Activity and Location History in a way that did not comply with the GDPR requirements, and that the company was unable to show it had met the GDPR principles when processing personal data through Location Accuracy.
The authority also claims that Google had not fulfilled its transparency obligations with respect to all three features and that it had kept the location data gathered through Web & App Activity and Location History longer than was necessary.
As Deputy Commissioner Graham Doyle pointed out, people might not have known that their location was being used, for instance, to show them advertisements or to work out their interests, and could thereby have lost control over their personal data; the keeping of users’ location information for longer than was necessary worsened this loss of control.
The DPC has imposed administrative fines amounting to €403 million and is requiring Google to bring its processing of user data into compliance within the following six months; however, the DPC has not yet published its full decision but has promised to do so.
Google’s Response and Unresolved Details
In a statement, Google said that it has modified its practices and policies and has introduced a mechanism which makes it easy to manage location data.
“The matter involves the historical policies which have since been updated; starting in 2019 we have made significant changes to our practices and have launched solid tools that simplify the management of location data,” the spokesperson stated.
Google states that it has introduced controls enabling users to specify a particular timeline for the automatic deletion of their data from their account. Now, the information in Google Maps Timeline is stored on the device and data older than three months is automatically deleted. The company also adds that it does not save the exact device location in Web & App Activity, only an estimated general area.
The full decision of the DPC has not yet been published, so the detailed reasons for the fine are not currently available. It has not been confirmed that Google will appeal the penalty.
The company says that the issue relates to historical policies which it has already changed, and the DPC has given it six months to bring its data processing into line, though the exact changes required have not been made public.
