Your cookie preferences

EDPB guidance · Art. 7 GDPR

We use technical cookies essential for the platform to work (login, security, sessions). We would also like to use analytics cookies to understand how to improve it.

You can accept all, reject all, or choose which categories to switch on.Your consent is valid for 6 months and you can withdraw it at any time from the footer.

You will find everything in our privacy notice.

All news
Enforcement September 23, 2026 6 min

Google, €403 million: half the findings live in your register

Six years of inquiry close on four findings. Two of them concern what every DPO handles daily: how long data is kept, and whether you can demonstrate what you claim

What the DPC decided

On 21 September 2026 the Irish Data Protection Commission announced its final decision on Google Ireland Limited. The inquiry was own-volition, opened in February 2020 after complaints from several European consumer organisations, including BEUC. Fines totalling €403 million and an order to bring the processing into compliance within six months. The full decision will be published in due course.

The scope is narrow and worth reading closely: three features — Web & App Activity, Location History and Location Accuracy — and a window running from 25 May 2018, the date the GDPR became applicable, to 4 February 2020. This is not a verdict on how Google works today. It is a verdict on twenty-two months eight years ago, arriving six years after the inquiry opened.

  • Lawfulness and fairness of the processing of location data in Web & App Activity and Location History.
  • Accountability: failure to demonstrate compliance with lawfulness, fairness and transparency for Location Accuracy.
  • Transparency, across all three features.
  • Retention of location data in Web & App Activity and Location History.

Two of those four findings have nothing to do with Google's scale. Retention and the ability to demonstrate sit in the record of processing of any client, including the one with four employees. Deputy Commissioner Graham Doyle says it plainly: keeping location data longer than necessary aggravated people's loss of control. It is not a finding added to pad the count, it is the multiplier of the others.

The finding worth pausing on

The second point does not say Location Accuracy was unlawful. It says Google was unable to demonstrate that it was lawful, fair and transparent. That is the accountability principle: the burden sits with the controller, and a six-year inquiry closed partly on it. Anyone who writes «legal basis: legitimate interest» without attaching the assessment is in the same position, only smaller.

For daily practice there are two things to do, and neither requires waiting for the full text. First: reread the register lines where retention says «for as long as necessary» and replace them with a criterion and with evidence that something actually happens at expiry. Second: for every processing operation resting on an assessment — legitimate interest, balancing, necessity — check that the assessment exists as a document and not as a conviction.

Official source:Data Protection Commission — Fines Google €403 million following Inquiry into Google's processing of location data (21/09/2026)Official source:Data Protection Commission — Decisions

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

Enforcement

The vendor's bug turned into a criminal conviction

On 7 September 2026, before the Dublin Metropolitan District Court, Brown Thomas Arnotts Limited pleaded guilty to five sample charges out of twenty-one for breaches of the Irish ePrivacy Regulations. Three concerned the absence of a valid opt-out address, two the sending of marketing without valid consent. The sum paid is two thousand euro. The sum is not the point: this was a criminal prosecution.

Sep 07, 2026New 5 min
Enforcement
24.000euros for an access authorised by the medical management

«Not unlawful, the medical management authorised it»: the Italian DPA says no, EUR 24,000

The case is small and the lesson is not. A hospital is at once a place of care and the employer of the same person, and when the two capacities touch, the health record becomes the handiest and most wrong tool. The employer had put it in writing to the prosecutor: that access was not unlawful, it was «carried out on the instructions of the medical management» «for the performance of the work». That is precisely the sentence the authority takes apart.

Sep 22, 2026New 6 min
Enforcement
72hours of retention never justified

Cameras in the changing rooms since 2007: the defence lists what they did not film, and loses

The defence brief is a list of things that were not visible: not the cubicles, not the showers, not the toilets; and near the lockers there are no benches «that might induce someone undressing to sit there and so be captured by the video system». It is reasoning by subtraction, and in a changing room it does not work. For the DPO, though, the passage to keep is another: among the provisions breached is Art. 5(1)(e), because the seventy-two hours of retention declared were not supported by any assessment showing they were necessary.

Sep 22, 2026New 5 min