The Data Protection Commission (DPC) has today announced its final decision following an Inquiry into Google Ireland Limited (“Google”). This own-volition Inquiry was launched by the DPC, in its function as the Lead Supervisory Authority for Google, in February 2020, following receipt of complaints from multiple European person entitlements organisations, including BEUC, concerning Google’s handling of location data in association alongside certain services and products.
The range of the Inquiry concerned Google’s handling of location data in three particular features – “Web & App Activity”, “Location History” and “Location Accuracy” between the date of use of the GDPR, 25 May 2018 to 4 February 2020.
The decision, which was made by the Commissioners for Data Protection, Dr Des Hogan, Mr Dale Sunderland and Ms Niamh Sweeney, finds that Google infringed the GDPR in regard of:
- the lawfulness and fairness of its handling of location data in Web & App Activity and Location History,
- its accountability obligations under the GDPR by failing to be capable to display compliance alongside the lawfulness, fairness and transparency regulation concerning its handling of individual data in Location Accuracy;
- its transparency obligations in regard of all three features referred to above; and
- its preservation of location data in Web & App Activity and Location History.
The DPC has imposed administrative fines totalling €403 myriad and has ordered Google to bring its handling into compliance inside 6 months.
Deputy Commissioner, Graham Doyle commented:
“Location data is a category of individual data which is processed by way of location tracking, and includes data collected or processed by Google, which by itself or in conjunction alongside another data an individual’s location can be inferred. Location data can bring the two benefits and harms to individuals. It can greatly enhance the usefulness of online services, but it can additionally disclose a important amount of data concerning an individual, including data that is inherently private.
The GDPR provides a elevated flat of safety of individual data throughout the EEA, and requires that the handling of individual data must be carried out in a lawful, fair and transparent manner. As a outcome of Google’s failures in this regard, individuals could have been unaware that their location was being used to, for example, power them alongside ads or to infer their interests, and could endure authority complete their individual data. The preservation of users’ location data for longer than necessary annoyed this defeat of control”.
The DPC is grateful for the collaboration and aid of its equal supervisory authorities in this case.
The DPC volition matter the complete decision in due course.
Background
Web & App Activity is a Google document environment that is lone accessible to Google Account holders. When enabled, Google uses this environment to procedure data connected to users’ action on Google services, including sites and apps. The data processed can contain individual data specified as browsing history, hunt history, and location data.
Location History is a Google assistance that keeps track of users’ location during in possession of their compatible mobile devices. Users must opt-in to Location History, which afterward processes all user’s data to infer location data specified as location visits, activities, and paths between location visits. Location History utilises a “Timeline” feature, which afterward displays a personal map (via Google Maps) to authorize the person to see anywhere they have travelled. Location History saves the personal map of anywhere the person goes alongside their signed-in devices, equal whenever the person is not using a Google service.
Location Accuracy is a characteristic of Android OS that allows an Android equipment to decide its location alongside greater accuracy than merely relying on inputs from the GPS component in the device. It is accessible to Android users despite of whether they are Google Account holders.
