Google v the DPC: Challenging a €403m Fine for Conduct That Ended Six Years Ago

On 9 November 2026, Google Ireland brought judicial review proceedings in the Irish High Court against the Data Protection Commission's decision of 21 September 2026, which imposed eight administrative fines totalling €403m, a reprimand and a six-month compliance order over location data processed through three features: "Web & App Activity", "Location History" and "Google Location Accuracy". The DPC had found breaches of lawfulness and fairness, transparency, accountability and storage limitation, including keeping location data in identifiable form longer than necessary. Google asks the court to quash the decision in whole or in part, seeks a stay and, if needed, a reference to the Court of Justice of the EU; it alleges errors of law and fact, manifest errors of assessment, flaws in the scope and conduct of the inquiry and in the use of corrective powers, and it intends to challenge the constitutionality of parts of the Data Protection Act 2018 and their compatibility with the European Convention and the EU Charter. With the DPC's consent, the case was entered into the Commercial List and adjourned. This matters because it is one of the largest GDPR penalties to date, and because the challenge targets not just the findings but the architecture of Irish enforcement itself.

In my view, the decision's real strength is that it went beyond consent and enforced storage limitation and accountability, two principles regulators rarely sanction at this scale; a company that cannot show why it still holds identifiable location data is exposed, whatever its consent screens say! The gap is time. The inquiry began in February 2020 after complaints led by consumer organisations including BEUC, and it concerns conduct between 25 May 2018 and 4 February 2020; the decision arrived more than six years after the inquiry opened. A sanction that arrives this late tells the market little about present practices, and a long procedure gives the controller exactly the kind of procedural arguments Google now raises about the scope and conduct of the inquiry. I believe the practical lesson cuts both ways: controllers should document a legal basis and a retention rationale feature by feature, because that file is what survives a six-year inquiry; and regulators should accept that speed is part of legitimacy. A fine that is lawful but late is still a weak deterrent!

Source: Irish Examiner, 9 November 2026; EDPB, 23 September 2026