Tech giant Google has brought a High Court challenge to a €403 million fine by the Data Protection Commission (DPC) over the processing of users’ location data.
On September 16th last, the DPC notified that it had made eight findings of infringement by Google Ireland Ltd of the General Data Protection Regulation (GDPR) in relation to three separate Google features called web and app activity, location history and Google location accuracy.
The DPC found Google had, among other things, infringed GDPR by unlawfully processing location data with the user’s activity when web and app activity was enabled and also in location history in respect of which the tech company relied on consent and the purpose of performing research and providing aggregate reporting, including ads measurement.
It also found Google had infringed GDPR by keeping location data associated with the user in their account when web and app activity was enabled “in a form permitting the identification of data subjects for longer than was necessary for the purposes for which those data were processed”.
RM Block
It also found Google failed to demonstrate compliance with the GDPR principle of lawfulness, fairness and transparency in processing data in Google location accuracy.
By way of corrective measures, the DPC imposed eight administrative fines totalling €403 million, issued a reprimand and made orders requiring Google to bring its processing into compliance within six months.
[ Explainer: Why it may take years for Google to pay its latest Irish fineOpens in new window ]
Google Ireland launched judicial review proceedings seeking orders annulling the decision in part and/or in whole. If necessary, it also sought a stay on the decision and a referral to the Court of Justice of the European Union.
Google says the DPC decision contains, and is vitiated by, a multiplicity of errors of law and fact, including manifest errors of assessment, errors concerning the scope and conduct of the inquiry (that the DPC carried out) and errors in the DPC’s exercise of its corrective powers.
It also intends to challenge the constitutionality of certain parts of the Data Protection Act 2018 and compatibility with the European convention and the Charter of Fundamental Rights of the European Union.
In an affidavit seeking entry of the case to the Commercial Court, Patrick Flynn, vice-president geo data operations of Google Ireland, said the proceedings were appropriate for entry into the fast-track commercial list given the value of fines involved and the material impact the decision would have on the company’s operations.
Google Ireland, he said, contends that compliance with any changes required by the decision will be disruptive and burdensome and will entail incurring significant cost.
On Monday, on the application of Paul Gallagher, counsel for Google Ireland, and on consent from Michael Cush, counsel for the DPC, Judge Eileen Roberts entered the matter to the commercial list and adjourned the case.
