The Data Protection Authority declares that the use of Google Analytics is illegal and orders website operators to remove Google Analytics
The French data protection authority,
Use of Google Analytics and data transfers to the United States: the CNIL orders a website manager/operator to comply | CNIL
https://www.cnil.fr/en/use-google-analytics-and-data-transfers-united-states-cnil-orders-website-manageroperator-comply
Google Analytics is a service used to measure the number of Internet users who visit a website and their routes. Google Analytics assigns a unique identifier to each visitor, and this identifier and related data are transferred by Google to a server in the United States. The identifier is a collection of information that can be used to identify each visitor, and therefore can be considered personal information.
The CNIL said it had received several complaints from the privacy organisation NOYB about the transfer of data collected on websites that use Google Analytics to servers in the US. NOYB had filed a total of 101 complaints in 27 EU Member States and three European Economic Areas .
Following a complaint from NOYB, the CNIL, together with its European counterparts, is analyzing the conditions under which data collected by Google Analytics is transferred to the U.S. and the risks posed to those involved in order to ensure consistency with the Schrems II ruling handed down by the Court of Justice of the European Union in 2020 on the cross-border transfer of personal data.
The CNIL argues that because the United States has not implemented an adequate level of data protection regulations in accordance with the GDPR , 'adequate guarantees should be provided' for data transfers, and in the case of Google Analytics, the CNIL concludes that these guarantees are 'not sufficient. Specifically, the data collected by Google Analytics and transferred to the United States could potentially be accessed by US intelligence agencies.
Therefore, the CNIL has ordered website operators to 'stop using Google Analytics and switch to tools that do not involve the transfer of data outside the EU' under Article 44 of the GDPR, citing the fact that the use of Google Analytics poses a significant risk to French website users. The CNIL has set a one-month grace period for complying with this order.
Regarding analytics services like Google Analytics, the CNIL recommends that they be used 'exclusively to generate anonymous statistical data.'
Related Posts:
in Web Service, Posted by logu_ii