New Delhi — Ireland’s Data Protection Commission has fined Google 403 million euros over its handling of users’ location data and ordered the company to bring its processing practices into compliance within six months.
The decision concerns Google services including Location History and Web & App Activity. Location History allows users who opt in to have their movements recorded through compatible mobile devices, enabling Google to infer information such as places visited, activities and routes between locations.
The commission found that Google violated the European Union’s General Data Protection Regulation in several areas, including the lawfulness and fairness of its processing of location data.
The regulator also found that Google failed to demonstrate compliance with GDPR requirements covering lawfulness, fairness and transparency in relation to the processing of personal data through Location Accuracy.
In addition, the DPC said Google violated GDPR rules by retaining location data collected through Web & App Activity and Location History.
“Location data is a type of personal data which is processed by way of location tracking, and includes data collected or processed by Google, which by itself or in conjunction with other information an individual’s location can be inferred,” Deputy Commissioner Graham Doyle said.
Doyle said location data can improve online services but can also reveal significant amounts of private information about individuals.
The GDPR requires personal data processing across the European Economic Area to be carried out in a lawful, fair and transparent manner.
“As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data,” Doyle said.
He added that retaining users’ location data longer than necessary worsened that loss of control.
The DPC said it will publish its full decision at a later date. (Source: IANS)
