Heraldo de Madrid - EU fines Google 403 mn euros for location data breach

The fine is the fourth largest imposed by the Data Protection Commission, the regulator said in a statement.

The DPC is responsible for overseeing Google at the European level because, like most tech giants, the company has its European headquarters in Ireland.

Google infringed the EU's General Data Protection Regulation between May 2018 and February 2020, the DPC said.

In its final decision after opening an inquiry in February 2020, the watchdog ruled that Google infringed GDPR "in respect of the lawfulness and fairness of its processing of location data in web and app activity and location history".

DPC deputy commissioner Graham Doyle said "as a result of Google's failures... individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests".

He added that "the retention of users' location data for longer than necessary aggravated this loss of control".

Alongside the fine, the regulator said it had ordered Google to comply with the European Union's GDPR within six months.

In response, Google said the "case centres around historical policies that have since been updated".

"From 2019 onwards, we've significantly evolved our practices and launched robust tools that make managing location data simple," the company added in a statement.

- 'Harmful late enforcement' -

In November 2018, the DPC received coordinated complaints from European consumer organisations in the Czech Republic, Denmark, Greece, the Netherlands, Norway, Poland, Slovenia and Sweden.

European Consumer organisation BEUC, which brought together the groups, called Monday's ruling "an important decision, close to eight years after a series of complaints" were lodged against Google.

"The decision is good news for consumers, as it holds Google accountable and confirms the illegality of the way the tech giant obtained consent to use peoples' location data," BEUC director general Agustin Reyna, said in a statement.

"However, the time needed to come to this conclusion is disproportionate with the seriousness of the infringement.

"Late enforcement can be as harmful as no enforcement at all. Consumers' fundamental rights need to be upheld faster and better," he added.

BEUC described geolocation data as "one of the most invasive forms of commercial surveillance because it reveals all kinds of sensitive information about us, such as our religious beliefs, our health condition, our political opinions or our sexual orientation".

Google is the subject of three other DPC investigations -- all "at an advanced stage" -- according to the regulator.

These include proceedings opened in September 2024 to determine whether the company is liable for failing to conduct an impact assessment regarding the use of Europeans' personal data to train Google's artificial intelligence.

The largest DPC fine was imposed on Facebook owner Meta in 2023 -- 1.2 billion euros for transferring data to the United States.

X.Villanueva--HdM