The Irish privacy regulator, known as the DPC, has proposed a €403 million fine for Google over its handling of location data from its European users. The DPC, which acts as the primary authority for most major US tech companies because they have their European operations based in Dublin, believes the company violated the General Data Protection Regulation (GDPR) between May 2018 and February 2020. During that time, tools such as 'Web & App Activity', 'Location History', and 'Location Accuracy' collected and processed location information without the transparency required by law.
The investigation began in February 2020, when several European consumer organizations, including BEUC, filed complaints about the lack of control users had over their own data. The ruling comes more than four years later and, in addition to the fine, includes a clear order: Google must adapt its data processing systems to current regulations within a maximum of six months. The case has become the fourth highest penalty imposed by the DPC, surpassed only by fines levied against other industry giants.
What exactly has Google done to deserve this penalty?
The DPC has found that Google did not process location data lawfully and fairly in its most frequently used functions. The data protection commissioners who made the decision emphasized that the company failed to demonstrate compliance with the principles of lawfulness, fairness, and transparency. In particular, location history and web and app activity were cited as the tools responsible for their lack of transparency in informing users about how their geolocation data was being used.
The lack of transparency wasn't the only problem. Retaining data for longer than necessary exacerbated the situation, according to regulators. This means that Google kept location information even when it was no longer essential for providing its services, making it difficult for users to delete their activity and search history . DPC Deputy Commissioner Graham Doyle was emphatic in explaining that this resulted in users losing control over their personal data, which could also be used for purposes such as targeting them with advertising or inferring their interests.
Why is location data so sensitive?
Location data is a particularly sensitive type of information because, combined with other information, it can reveal very intimate details of a person's life. Visits to a hospital, a place of worship, or children's school are patterns that can be inferred from location tracking. Doyle has emphasized that this data can bring benefits to online services, but it can also expose inherently private information if not handled with adequate safeguards.
BEUC, which has been denouncing these practices for over eight years, has celebrated the decision as a victory for consumers, albeit with some reservations. Its director general, AgustÃn Reyna, pointed out that the slowness of the process is worrying: "A delayed application of the law can be as harmful as its complete absence." According to Reyna, fundamental consumer rights must be protected more quickly and effectively.
More regulatory pressure on big tech companies
The penalty is not an isolated case. Brussels and national regulators have stepped up their scrutiny of internet giants in recent years, issuing fines for everything from anti-competitive practices to privacy violations. Google has already accumulated several sanctions in Europe , and this latest fine adds to a growing list that also includes other companies like Meta. The DPC has acted as the main point of contact with the EU for many of these companies because their European headquarters are based in Ireland.
The consumer organization BEUC has insisted that geolocation is one of the most invasive tools within the tech companies' business model. Tracking hundreds of millions of Europeans to extract information about their private lives, from religious beliefs to sexual orientation, is a practice they consider unacceptable, especially when more respectful alternatives to Google Maps exist . The DPC's decision, although belated, sets an important precedent for future cases involving the processing of personal data.
The company did not immediately respond to requests for comment following the publication of the penalty. Meanwhile, the DPC's decision has already been adopted by Commissioners Des Hogan, Dale Sunderland, and Niamh Sweeney, following a cooperative process with other European supervisory authorities. The full resolution is expected to be published shortly, providing a complete record of the case.
With this sanction, the DPC has made it clear that companies must assume their responsibilities when handling personal data. The €403 million fine and the six-month deadline to comply with the regulations serve as a wake-up call for the entire sector. The protection of location data, which can reveal so many aspects of our daily lives, has become a key battleground in the defense of Europeans' privacy. Although the ruling has taken years to arrive, it has at least arrived with the forcefulness that consumers have long awaited.
