A €403 million fine with no data breach: what the Google location decision means for your privacy notice

Oct 7

5 min read

Updated: Oct 8

In September 2026, Ireland's data protection regulator fined Google Ireland Limited €403 million over how it handled users' location data. Nothing was hacked and nothing leaked. For Philippine organizations, the lesson is close to home: tell people clearly what you do with their data.

Key takeaways:

Ireland's Data Protection Commission (DPC) fined Google Ireland Limited €403 million for processing location data between 25 May 2018 and 4 February 2020.
This was not a data breach case. The findings concern lawfulness and fairness, accountability, transparency and how long data was kept.
Among the findings: people were not clearly told how their location data was being used.
Transparency is also a core principle of the Philippine Data Privacy Act of 2012.A good test of any privacy notice: could a customer explain back to you how you use their data?

What the regulator decided

On 21 September 2026, the DPC announced the outcome of an inquiry into how Google Ireland Limited processed location data through three account settings: Web & App Activity, Location History and Location Accuracy. The inquiry covered the period from 25 May 2018, the day the EU's General Data Protection Regulation (GDPR) took effect, to 4 February 2020.

The DPC's findings fall into four areas:

Lawfulness and fairness of the processing of location data in Web & App Activity and Location History.
Accountability obligations in relation to Location Accuracy.
Transparency obligations across all three settings.
Retention of location data in Web & App Activity and Location History.

The company was fined €403 million and given six months to bring its processing into compliance. The DPC has said it will publish the full decision in due course, and a decision of this kind may be challenged in court.

Explaining why location data matters, DPC Deputy Commissioner Graham Doyle said it "can greatly enhance the utility of online services, but it can also reveal a significant amount of information" about a person.

Why a fine with no breach deserves attention

Most organizations think of privacy risk as a security problem: a hack, a lost laptop, a leaked file. This decision is a reminder that regulators also look at ordinary, everyday processing. The questions here were simple ones. Did people understand what was being collected? Did the settings do what users were told they did? Was the data kept longer than needed?

Those questions can be asked of any organization, of any size, on any day. No incident is required.

The same principle in Philippine law

The Data Privacy Act of 2012 (Republic Act No. 10173) is built on three general principles. Section 11 allows the processing of personal information subject to "adherence to the principles of transparency, legitimate purpose and proportionality."

The Act then makes transparency practical. Under Section 16, a person has the right to be informed whether their personal information is being processed, and to be given key details before their data enters your system, or at the next practical opportunity. Those details include what data is collected, the purposes, who receives it, how long it is kept, and the rights the person has.

Retention is covered too. Section 11(e) says personal information must be "retained only for as long as necessary" for the purposes for which it was obtained, for legal claims, for legitimate business purposes, or as provided by law.

So the areas the Irish regulator examined, clear information and limited retention among them, are ones the National Privacy Commission can also examine here.

Why this matters for Philippine organizations

SMEs and growing companies. If your privacy notice was copied from a template, it probably describes someone else's business. A notice only protects you if it matches what you actually do.

Apps, e-commerce and fintech. Location, device and behavioural data are the hardest to explain and the most revealing. If your app asks for location access, the user should know why, what it is used for, and how to turn it off.

BPOs, IT-BPM and developers serving EU clients. You may never deal with a European regulator directly, but its expectations reach you through your contracts. Clients are asked to prove that their notices and settings are accurate, and they will ask the same of the teams that build and run their systems.

Five checks for your privacy notice

These are practical checks we suggest, not a regulator's checklist.

Read it as a customer would. Is it in plain language? Could someone outside your company follow it?
Match it to reality. List what you actually collect, including through apps, cookies and third-party tools, and compare it with what the notice says.
Check your settings. If a user switches something off, does the collection really stop? A setting that says one thing and does another is the fastest way to lose trust.
Say how long you keep data. Then check that your systems delete it on that schedule.
Run the explain-back test. Ask a few customers or new employees to describe how you use their data after reading the notice. If they can't, rewrite it.

Trust that travels

Clear privacy notices are not only about avoiding penalties. They are one of the first things a foreign client, partner or auditor reads when deciding whether to trust you with their customers. Getting them right is a simple way for Philippine organizations to show they meet the standard global business expects.

Frequently asked questions

Was this a data breach? No. The DPC's announcement describes findings about how location data was processed, explained and retained. It does not describe a security breach.

Does the GDPR apply to my Philippine company? It depends on your activities. Many Philippine organizations meet GDPR requirements indirectly, through contracts with EU clients whose data they handle. Whether the GDPR applies to you directly needs a case-by-case assessment.

What does the Data Privacy Act require me to tell people? Section 16 lists the details, including the data collected, the purposes, the recipients, how long it is kept, who the controller is and what rights the person has.

Is a privacy notice the same as consent? No. A notice informs people about your processing. Consent is one of several legal bases for processing. You need a clear notice whichever basis you rely on.

Talk to us

If you would like a second pair of eyes on your privacy notice, or want to check that your app settings match what you tell users, we at PrivaLex are glad to help. Message us or book a short scoping call at hello@privalex.com.ph.