New Delhi, Sep 21 (IANS): The Data Protection Commission (DPC) in Ireland on Monday imposed a penalty of 403 million euros on Google, ordering the tech giant to bring its location data processing into compliance within six months.
‘Location History’ is a Google service that keeps track of users’ location while in possession of their compatible mobile devices.
Users must opt-in to Location History, which then processes each user’s data to infer location information such as place visits, activities, and paths between place visits.
The EU data privacy regulator’s decision, made by the Commissioners for Data Protection, Dr Des Hogan, Dale Sunderland and Niamh Sweeney, found that Google infringed the GDPR in respect of the lawfulness and fairness of its processing of location data in Web & App Activity and Location History and its accountability obligations under the GDPR by failing to be able to demonstrate compliance with the lawfulness, fairness and transparency principle regarding its processing of personal data in Location Accuracy,
Google also infringed the GDPR by retaining location data in Web & App Activity and Location History.
“Location data is a type of personal data which is processed by way of location tracking, and includes data collected or processed by Google, which by itself or in conjunction with other information an individual’s location can be inferred. Location data can bring both benefits and harms to individuals. It can greatly enhance the utility of online services, but it can also reveal a significant amount of information about an individual, including information that is inherently private,” said Deputy Commissioner, Graham Doyle.
The GDPR provides a high level of protection of personal data throughout the EEA and requires that the processing of personal data must be carried out in a lawful, fair and transparent manner.
“As a result of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, influence them with ads or to infer their interests, and could lose control over their personal data. The retention of users’ location data for longer than necessary aggravated this loss of control,” Doyle mentioned.
The DPC said it will issue the full decision in due course.
