Jan 20, 2022 12:12:00

Google Analytics may be illegal in the EU after a ruling that 'data transfer to Google is illegal'

The Austrian data protection authority Datenschutzbehörde (DSB) has ruled that the use of Google Analytics by a German company violates EU law.

Standarderledigung Bescheid --E-DSB --Google Analytics_DE_bk_0.pdf
(PDF file)

https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Google%20Analytics_DE_bk_0.pdf

Austrian DSB: EU-US data transfers to Google Analytics illegal
https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal

German company's use of Google Analytics'breached GDPR' • The Register
https://www.theregister.com/2022/01/13/google_analytics_gdpr/

Google Analytics declared illegal in the EU.
https://tutanota.com/blog/posts/google-analytics/

Google Analytics is Google's access analysis service that can track user movements on websites in detail. In 2020, the European Commission's special measure on the transfer of personal data from the EU to the United States, saying that Facebook's transfer of user's personal data to the United States violates the EU General Data Protection Regulation (GDPR) The EU Court of Justice (CJEU) has ruled to revoke the 'Privacy Shield', requiring companies such as Facebook and Google to manage data in accordance with the Standard Contract Clause (SCC), which includes a more effective system. became.

However, it has since been pointed out that 101 companies in the EU and European Economic Area (EEA) member countries are operating data contrary to SCC. It is expected that the other 100 companies will be given similar judgments after the German company in question was found to be illegal for the first time in the EU and EEA.

The DSB said, 'The operation of the German company in question does not rule out the possibility of monitoring and access by US intelligence, and guarantees an appropriate level of protection in accordance with the GDPR. It wasn't. SCC isn't enough to comply with EU law, 'arguing that compliant with SCC does not rule out allegations of GDPR violations.

Since this judgment is an enforcement procedure before the objection is filed, no penalties will be imposed on German companies at this stage, but the possibility of penalties in the future cannot be ruled out.

Austrian nonprofit organization noyb , the petitioner of the proceedings, praised it as 'one of the greatest successes to date' and 'twice in a year and a half have been sentenced to US cloud services. So it's only a matter of time before the law comes into force. '