Background information

• Date of final decision: 21 September 2026
• National case
• Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) and Article 13 (Information to be provided where personal data are collected from the data subject)
• Decision: Administrative fine, compliance order
• Key words: GDPR enforcement, technology, accountability, data subjects rights

Summary of the Decision

Origin of the case  

The Irish Data Protection Commission (DPC) has announced its final decision following an inquiry into Google Ireland Limited (Google). This own-volition Inquiry was launched by the DPC, in its role as the Lead Supervisory Authority for Google, in February 2020, following receipt of complaints from several European consumer rights organisations, including BEUC, regarding Google’s processing of location data in connection with certain services and products.

The scope of the Inquiry concerned Google’s processing of location data in three specific features – “Web & App Activity”, “Location History” and “Location Accuracy” between the date of application of the GDPR, 25 May 2018 to 4 February 2020.

Key Findings

The decision, which was made by the Commissioners for Data Protection, finds that Google infringed the GDPR in respect of:

• the lawfulness and fairness of its processing of location data in Web & App Activity and Location History;
• its accountability obligations under the GDPR by failing to be able to demonstrate compliance with the lawfulness, fairness and transparency principle regarding its processing of personal data in Location Accuracy;
• its transparency obligations in respect of all three features referred to above; and
• its retention of location data in Web & App Activity and Location History.

Decision

The DPC has imposed administrative fines totalling 403 000 000 EUR and has ordered Google to bring its processing into compliance within 6 months.

For further information: 

• Data Protection Commission fines Google €403 million following inquiry into Google’s processing of location data