Ireland’s Data Protection Commission has fined Google €403 million following an inquiry into the company’s processing of location data. The regulator announced its final decision on September 21, addressing historical practices associated with Web & App Activity, Location History and Android’s Location Accuracy feature.
What the inquiry examined
The DPC said its investigation considered whether Google processed location data lawfully, fairly and transparently under the European Union’s General Data Protection Regulation. Ireland acts as Google’s lead privacy regulator in the EU because the company’s European headquarters is in Dublin. The inquiry covered practices dating from the GDPR’s introduction in 2018 through February 2020.
Location data can support navigation, device services and personalized applications, but it can also reveal sensitive patterns about where a person lives, works or travels. That makes consent, transparency, purpose limitation and user controls central to privacy risk. Google said the case concerned historical policies and pointed to changes introduced since 2019.
Security and governance implications
The decision is relevant beyond consumer privacy teams. Physical-security and workplace applications increasingly combine mobile credentials, geofencing, visitor systems and location-aware services. Organizations using these capabilities should document why location information is collected, limit retention, control downstream access and verify that user-facing explanations match actual processing. Security value does not remove legal obligations. Broader coverage of connected-system governance appears in SectechMedia’s cyber-physical security channel.
Leave a Reply