Google Fined $462 Million for Location Data Privacy Violations

Google has been fined €403 million, equivalent to approximately $462 million, by Ireland's Data Protection Commission (DPC) for its handling of user location data. This substantial penalty, announced on Monday, represents one of the largest fines ever issued by the Irish regulatory authority. The investigation, which commenced in early 2020, concluded that Google had violated the European Union's General Data Protection Regulation (GDPR) concerning the processing of personal data. The DPC has also mandated that Google must bring its location data processing practices into compliance with GDPR within a six-month period.

Graham Doyle, the deputy commissioner, stated that Google's failures meant individuals might have been unaware that their location data was being used for purposes such as targeted advertising or inferring interests. This lack of transparency and control over personal data was exacerbated by the retention of users' location data for longer than necessary, according to Doyle. The GDPR mandates that the processing of personal data must be conducted in a "lawful, fair and transparent manner." Google did not immediately respond to a request for comment from Fast Company regarding the ruling.

This fine is the latest in a series of regulatory actions against Google and the broader Big Tech industry globally. In a separate antitrust case, a federal judge recently ruled that Google must implement various remedies instead of breaking up its advertising technology business, following a monopolization lawsuit filed by the U.S. Department of Justice. Furthermore, this Irish DPC fine comes approximately one year after a federal jury ordered Google to pay $425.7 million to around 98 million individuals. That class-action lawsuit alleged that Google continued to collect data from third-party apps from smartphone users, even after they believed they had disabled a key setting that would prevent such data collection.

The ruling by the Irish commission specifically focused on how Google processed location data, impacting users' privacy and control over their personal information. The GDPR, enacted in 2018, aims to give individuals more control over their personal data and holds organizations accountable for how they collect, process, and store this information. The commission's findings indicate that Google's practices did not meet these stringent requirements, leading to the significant financial penalty and the order for corrective action.