France’s privacy watchdog finds Google Analytics violates GDPR – JURIST
The CNIL, the data watchdog in France, announced on Thursday that Google does not guarantee the protection of European data according to GDPR standards. It analyzed the conditions under which the data is transferred to the United States via Google Analytics, a service determining the frequentation of the site by an Internet user.
The investigation by the CNIL and its European counterparts came after receiving 101 complaints from the NYOB in the 27 EU member states and three other states of the European Economic Area (EEA) against 101 data controllers who allegedly transferred personal data in the United States.
The statement follows a critical 2020 ruling by the European Court of Justice, which raised the bar for the region’s privacy watchdogs after the ECJ expressed reservations about US surveillance laws and measures in place to protect individuals’ data from unauthorized access. The CNIL has found that the transfer of Internet user data to the United States violates articles 44 and following. of the GDPR, which regulates transfers of personal data to third countries or international organizations that do not have equivalent privacy protections.
He noted that despite additional measures taken by Google to regulate the transfer of data, the current mechanism is insufficient to prevent US intelligence services from accessing the data.
The CNIL ordered the manager of the site under investigation to bring their processing into compliance with the GDPR either by ceasing to use Google Analytics or by switching to a technology that does not involve the transfer of data outside the EU.
Last month, the Austrian data protection authority also concluded that data transfers between the EU and the US by Google Analytics were unlawful. In early January, the European Data Protection Supervisor also issued a decision finding that the European Parliament’s use of Google Analytics on its COVID testing website violated the bloc’s data protection law. A cumulative effect of these developments could suggest the end of Google Analytics services in the European Union.