Ireland’s Data Protection Commission (DPC) has fined Google €403 million following its own-volition inquiry into how Google processed location data through its Web & App Activity, Location History, and Location Accuracy settings between May 2018 and February 2020.
Key points
- The DPC found the processing of location data through Web & App Activity and Location History unlawful and unfair.
- It found failures of transparency across all three settings, and of accountability for Location Accuracy.
- It found that Google kept location data for longer than necessary.
- Google must bring its processing into compliance within six months, as well as paying the fine.
The decision is a reminder that location data can reveal a great deal about people, and that default settings and bundled consents attract regulatory scrutiny. Any organisation collecting location data from apps, devices, or websites should check its lawful basis, the clarity of its privacy information, and its retention periods.
Source: Data Protection Commission
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
