Irish Data Protection Commission Imposes Fine on Google Ireland Limited
The Irish Data Protection Commission (DPC) has published a final decision against Google Ireland Limited. The subject matter was an inquiry initiated by the DPC into the processing of location data in connection with certain services and products. According to the European Data Protection Board, the final decision was adopted on 21 September 2026.
The DPC imposed fines on Google Ireland Limited totalling EUR 403,000,000. In addition, the company was ordered to bring the contested processing operations into compliance with the requirements of the General Data Protection Regulation (GDPR) within six months.
Background to the Inquiry
Lead Role of the Irish Supervisory Authority
The addressee of the decision is Google Ireland Limited. As the European headquarters of the Alphabet group, the company falls, according to the published information, within the jurisdiction of the Irish Data Protection Commission as the lead supervisory authority.
The inquiry was initiated by the DPC on its own initiative in February 2020. It was prompted by complaints previously submitted by several European consumer organisations, including BEUC, in connection with Google’s processing of location data.
The original complaints were filed in November 2018 by consumer organisations from several European states, including Norway, the Netherlands, Greece, the Czech Republic, Slovenia, Poland and Sweden. According to the information published in this regard, German, Austrian or Swiss organisations were not among the complainants.
Connection with Investigations by the Norwegian Consumer Council
The complaints were based, among other things, on investigations by the Norwegian Consumer Council Forbrukerrådet. According to those investigations, Google is alleged to have designed user interfaces in such a way that the Location History and Web & App Activity functions remained enabled.
The DPC did not examine the matters in general terms, but in relation to specific functions and a specific period. The inquiry covered the processing of location data between 25 May 2018, the date on which the GDPR became applicable, and 4 February 2020.
Subject Matter of the Decision
Three Functions in Focus
According to the communication from the European Data Protection Board, the inquiry concerned three specific functions:
- “Web & App Activity”,
- “Location History”,
- “Location Accuracy”.
The examination concerned, among other things, location settings in services such as Google Search and Google Maps, as well as the location accuracy function on Android devices.
The focus was therefore on processing operations that may have considerable practical significance for the use of digital services and mobile devices. However, the decision concerns only the functions named in the inquiry and the period specified there.
Relevant Provisions of the GDPR
The DPC based its decision on provisions of the General Data Protection Regulation. The publication by the European Data Protection Board specifically refers to the following provisions:
- Art. 5 GDPR on the principles relating to processing of personal data,
- Art. 6 GDPR on the lawfulness of processing,
- Art. 12 GDPR on transparent information, communication and modalities for the exercise of the rights of data subjects,
- Art. 13 GDPR on information obligations where personal data are collected from the data subject.
The decision comprises both a fine and an order to establish a condition compliant with data protection law.
Findings of the Data Protection Commission
Lawfulness and Fairness of Processing
According to the published summary, the DPC found infringements of the GDPR in connection with the lawfulness and fairness of the processing of location data. These findings relate to the “Web & App Activity” and “Location History” functions.
The decision therefore does not concern all conceivable processing of location data by Google, but rather the specifically examined functions and the defined inquiry period. This limitation is decisive for the legal assessment.
Accountability Obligations for “Location Accuracy”
In addition, the DPC criticised compliance with accountability obligations under the GDPR in relation to “Location Accuracy”. According to the published decision, Google was unable to demonstrate, with respect to this function, that the principles of lawfulness, fairness and transparency were observed in the processing of personal data.
The finding therefore concerns the obligation to demonstrate compliance in relation to the processing of personal data in “Location Accuracy”. It must be distinguished from the further findings regarding the “Web & App Activity” and “Location History” functions.
Transparency Obligations for All Three Functions
The DPC also found infringements of transparency obligations. These findings related to all three functions mentioned: “Web & App Activity”, “Location History” and “Location Accuracy”.
Art. 12 GDPR and Art. 13 GDPR require that information be provided to data subjects in a transparent, intelligible and easily accessible form. According to the published summary, the DPC’s decision turns on the question of whether Google had met these requirements in relation to the functions examined.
Storage of Location Data
A further part of the decision concerns the storage of location data. According to the communication from the European Data Protection Board, the DPC criticised the retention of location data in “Web & App Activity” and “Location History”.
Amount of the Fine and Further Procedural Aspects
Classification of the Fine
The fines imposed amount in total to EUR 403,000,000.
Six-Month Implementation Period
In addition to the fine, the DPC ordered Google to bring the processing into compliance with the GDPR within six months. The order relates to the contested processing operations addressed in the decision.
Reactions to the Decision
Statement by Google
Google stated that the matter concerned earlier or historical practices. Since 2019, the company said it had further developed its procedures and introduced tools enabling users to manage location data more easily.
This statement does not alter the fact that the DPC’s decision concerns the period from 25 May 2018 to 4 February 2020. The decisive factors remain the supervisory authority’s findings on the processing operations examined in the inquiry.
Assessment by Consumer Organisations
At the same time, BEUC criticised the duration of the proceedings. According to the organisation, around eight years elapsed between the complaints and the decision. In its assessment, delayed intervention may have a similarly detrimental effect to a failure to intervene.
Data Protection Significance for Companies
The decision illustrates the high practical relevance of transparency, lawfulness, fairness and accountability obligations in the processing of personal data. This applies in particular to location data, because such data may allow conclusions to be drawn about the movements, habits and interests of data subjects.
For companies with data-driven business models, the case shows that supervisory authorities examine not only the formal existence of information and settings. It is also important whether the processing operations are explained in a comprehensible manner and whether compliance with the relevant principles can be demonstrated.
According to the published information, three further major statutory inquiries against Google are currently ongoing at the DPC, each of which, according to the authority, is at an advanced stage. No statement can therefore be made as to their outcome.
Advice on Data Protection and GDPR Compliance
The decision of the Irish Data Protection Commission underscores that data protection infringements can have significant economic and regulatory consequences. Particularly in the context of international data processing, digital business models and the use of location-based data, complex questions frequently arise regarding the GDPR, information obligations and the accountability obligation.
MTR Legal Rechtsanwälte advises companies, investors and high-net-worth private individuals on data protection law matters with a commercial law dimension. Further information can be found under legal advice in data protection law.
