Articles

Digital Law Up(to)date: Google Analytics and GPDR: a violation of the rules on international data transfers

Digital Law Up(to)date: Google Analytics and GPDR: a violation of the

Digital Law Up(to)date: Google Analytics and GPDR: a violation of the rules on international data transfers

24.01.2022 EU law

The Datenschutzbehörde, the Austrian Data Protection Authority (DPA), found that the use of the free version of Google Analytics violated some provisions of the General Data Protection Regulation (GDPR), and specifically the rules on the international data transfers.

The Datenschutzbehörde, the Austrian Data Protection Authority (DPA), found that the use of the free version of Google Analytics violated some provisions of the General Data Protection Regulation (GDPR), and specifically the rules on the international data transfers. The decision of 22 December 2021 (available in German with a machine translation in English, here) is the first decision on the 101 complaints on EU-US data transfers filed by Noyb (see here), the association of Max Schrems, in the wake of the decision “Schrems II” of the Cour of justice of European Union (see here).

Firstly, the Austrian DPA considered that the website operators using Google Analytics are to be considered as data controllers and that Google is to be considered as processor. Standard Contractual Clauses (SCCs) and some additional measures furthermore framed the export of personal data to the United States.  

But, the main issue is that Google processes data from Google Analytics on American servers. According to the US law, Google is an “electronic communications service provider”. In practice, this means among other that US intelligence services can have access to these European Data. The Austrian DPA therefore considered that the level of protection of the European Data was not sufficient. 

As mentioned above, Noyb filed in 2020 101 complaints in European States. will be very interesting to see how the other national Data Protection Authorities position themselves. It is clear that the Austrian decision is an important precedent. For example, the Dutch DPA has already modify a question on its website on the use of Google Analytics. It states that the use of Google Analytics may not be permitted soon (with a reference to the Austrian decision) and that there is currently investigation about two complaints about the use of Google Analytics in the Netherlands (see here).


By Edouard Cruysmans and Erik Valgaeren

 

Team

Related news

10.03.2022 EU law
De Dataverordening (“Data Act”)

Short Reads - De Europese Commissie heeft op 23 februari 2022 de Europese dataverordening (“Data Act”) voorgesteld, die het delen van data beoogt te bevorderen. Steeds meer gegevens worden door mensen en machines gegenereerd, bewaard en hergebruikt. Data en data-analyse kan een bijdrage leveren aan de efficiëntie van maatschappelijke processen, onderzoek en innovatie stimuleren en het concurrentievermogen van industrieën versterken. Veel data is echter niet vrij toegankelijk.  

Read more

11.05.2022 NL law
De afweging van grondrechten in het kader van corona

Articles - COVID-19 heeft de maatschappij voor dilemma’s geplaatst bij de afweging van volksgezondheid en bescherming van kwetsbaren tegenover vrijheden van het individu. In Tijdschrift voor Arbeidsrecht in Context schetsen Frederiek Fernhout en Judica Krikke de onderliggende rechten en vrijheden die vastgelegd zijn in het Europese grondrechtenkader, de AVG en nationale arbeidswetgeving en bespreken zij hoe deze tegen elkaar moeten worden afgewogen in de context van coronamaatregelen.

Read more

26.04.2022 EU law
Digital Law Up(to)date: Further clarification by the CJEU on the retention of traffic and location electronic communications data for the purpose of combating serious crime

Articles - On 5 April 2022, the Grand Chamber of the Court of Justice of the European Union first confirmed that EU law precludes national legislative measures which provide, as a preventative measure, for the general and indiscriminate retention of traffic and location data relating to electronic communications, for the purpose of combating serious crime.

Read more