Data Protection Authority declares Google Analytics inadmissible

Feb 4, 2022 Benn-Ibler Rechtsanwälte

As a consequence of the "Schrems II" ruling of the European Court of Justice (ECJ), the Data Protection Authority (DPA) has deemed the use of Google Analytics to be a violation of the General Data Protection Regulation (GDPR).

Google Analytics is a programme that allows website operators to measure and analyse their website traffic. The programme collects data from HTTP requests from users, reads browser information (e.g. version number, operating system) and sets and reads (first-party) cookies. In the process, unique identification numbers (IDs) are assigned. If a user is logged in with their Google account at the same time, Google can technically determine which user is visiting a page. Data is also transferred to servers in the USA.

The data protection NGO "noyb" criticises this. Since the ECJ overturned the EU-US Privacy Shield (an adequacy decision under Article 45 of the GDPR), the transfer of personal data to the USA is only permissible if suitable guarantees can be presented that provide an adequate level of protection for data in the third country as in the EU. This is not the case with Google Analytics, because Google is obliged under US law to cooperate with intelligence services.

The DPA also sees it the same way:

In order to ensure a sufficient level of protection when transferring data to the third country USA, either contractual guarantees (e.g. standard data protection clauses) or organisational and technical measures are needed.

According to the DPA, standard data protection clauses alone are not sufficient because - as contracts - they cannot bind US intelligence services. All of Google's technical measures – particularly encryption - cannot be sufficient either, because Google is obliged under US law to grant the intelligence services access to the data in their possession. This explicitly also applies to the necessary cryptographic keys.

"Noyb" expects similar decisions throughout Europe.

DSB D155.027 2021-0.586.257 (22.12.2021)