The watchdog said Google Ireland Limited failed to meet requirements under the General Data Protection Regulation covering lawfulness, fairness, transparency, accountability and data retention. The inquiry examined practices linked to Web & App Activity, Location History and Location Accuracy between May 25, 2018, when the GDPR took effect, and February 4, 2020.
The DPC said the failures meant people could have been unaware that their location information was being used to shape advertising or infer their interests, reducing their ability to control personal data. It also found that retaining location information longer than necessary aggravated that loss of control.
Google has been ordered to bring the processing covered by the decision into compliance within six months. The company said the case concerned policies from an earlier period that had since been changed and indicated that it intended to appeal aspects of the ruling.
A Google spokesperson said the company had substantially changed its location-data practices from 2019 onwards and introduced tools designed to make controls easier for users. Those changes include options to delete data automatically, additional advertising controls and clearer explanations of how location information is handled.
The DPC launched its own-volition inquiry in February 2020 after receiving complaints from several European consumer organisations, including the European Consumer Organisation, BEUC. Ireland’s regulator acts as Google’s lead supervisory authority under the GDPR because the company’s main European establishment is in Ireland.
Commissioners Des Hogan, Dale Sunderland and Niamh Sweeney made the final decision. The DPC said Google infringed the lawfulness and fairness requirements governing location data processed through Web & App Activity and Location History.
It also found that Google failed to demonstrate compliance with the GDPR’s lawfulness, fairness and transparency principles for data processed through Location Accuracy. Transparency obligations were breached across all three features, while the regulator separately identified problems with retention periods for Web & App Activity and Location History data.
Web & App Activity is an account setting that allows Google to process information generated by a user’s activity across its services, including browsing, searches and location information. Location History, which users opt into, records location information that can be used to infer visits, movements and routes and can display that information through the Timeline feature in Google Maps.
Location Accuracy is an Android function that improves positioning beyond a device’s GPS input by using additional signals. Unlike the other two features, it can apply to Android users whether or not they hold a Google account.
DPC Deputy Commissioner Graham Doyle said location information could improve the usefulness of digital services but could also reveal a substantial amount of private information about an individual.
He said the GDPR required personal data to be handled lawfully, fairly and transparently, adding that shortcomings in Google’s practices could leave individuals unaware of how location information was being used. The regulator said such data, alone or when combined with other information, can allow a person’s movements or whereabouts to be inferred.
The €403 million sanction is among the largest penalties imposed by Ireland’s privacy regulator since the GDPR came into force. The DPC has previously issued higher fines against other major technology platforms and has become one of Europe’s most closely watched regulators because several large US technology groups base their EU operations in Ireland.
The watchdog said it had worked with other European supervisory authorities on the Google case and would publish the full decision at a later stage. Three other large-scale statutory inquiries concerning Google remain under examination by the Irish regulator.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
