Google Fined Over €400 Million by Irish Regulator for GDPR Location Data Breaches

Ireland’s Data Protection Commission (DPC) has fined Google more than €400 million (approximately £345 million) for violations of the General Data Protection Regulation (GDPR) concerning its processing of user location data. The significant penalty underscores the increasing regulatory scrutiny faced by major technology firms over their data handling practices in Europe.

Details of the Ruling

The fine follows a six-year investigation launched by the Irish regulator after receiving complaints from several European consumer rights organizations. The DPC, which acts as the lead EU privacy regulator for Google because its European headquarters is in Ireland, examined the company's practices between May 25, 2018, and February 4, 2020.

The commission's probe focused on whether Google processed location data lawfully and fairly and met its accountability obligations under GDPR. Specifically, the investigation centered on features including "web and app activity," "location history," and "location accuracy."

Ad

Key Findings and Implications

Regulators determined that Google users may not have been sufficiently aware that their location information was being used to target them with advertisements or to profile their interests. The lack of transparency was a key factor in the DPC's decision.

In addition to the financial penalty, which is the fourth largest issued by the DPC since GDPR was implemented, Google has been ordered to bring its data processing operations into compliance within six months. For investors, this ruling highlights the persistent financial and operational risks associated with data privacy regulations for technology companies that rely on user data for advertising revenue.