The decision on this complaint has clear implications for any website based in France that’s currently using Google Analytics - or, indeed, any other tools that transfer personal data to the U.S. Which suggests the CNIL could issue guidance in future that recommends GDPR compliant alternatives to Google Analytics. because they only produce anonymous statistical data which can be exported legally under GDPR).

The CNIL also suggests use of an alternative analytics tool which does not involve a transfer outside the EU to end the breach.Īdditionally, it says it’s launched an evaluation program to determine which website audience measurement and analysis services may be exempt from the need to obtain user consent (i.e. The French regulator is also very emphatic that under “current conditions” use of Google Analytics is non-compliant - and may therefore need to cease in order for the site in question to comply with the GDPR. (And the Austrian decision against Google Analytics last month took a broad interpretation of what constitutes personal data in this context, finding that an IP address could be enough given how it may be combined with other bits of data held by Google to identify a site user.) The CNIL does leave open the door to continued use of Google Analytics - but only with substantial changes that would ensure only “anonymous statistical data” gets transferred. “There is therefore a risk for French website users who use this service and whose data is exported.” intelligence services,” the CNIL writes in a press release announcing the decision. “lthough Google has adopted additional measures to regulate data transfers in the context of the Google Analytics functionality, these are not sufficient to exclude the accessibility of this data for U.S. One of THE European DPA powerhouses now also taking a position on #GoogelAnalytics and our complaints. Including another by the European Data Protection Supervisor last month, also involving Google Analytics. While it has taken EU regulators some time to act on illegal data transfers - despite an immediate warning from the European Data Protection Board of no grace period in the wake of the July 2020 CJEU ruling (aka ‘Schrems II) - decisions are now finally starting to flow. Since then ( indeed, long before) the legality of transatlantic transfers of personal data have been clouded in uncertainty. Privacy Shield agreement on data transfers. Whereas the EU’s GDPR demands that data protection travels with citizens’ information as a stipulation of legal export.įrance’s CNIL has been investigating one of 101 complaints filed by European privacy advocacy group, noyb, back in August 2020 - after the bloc’s top court invalidated the EU-U.S. citizens with any way to know whether their data is being acquired, how it’s being used or to seek redress for any misuse.

fails this critical equivalence test on account of having sweeping surveillance laws which do not provide non-U.S. The French data protection watchdog, the CNIL, said today that an unnamed local website’s use of Google Analytics is non-compliant with the bloc’s General Data Protection Regulation (GDPR) - breaching Article 44 which covers personal data transfers outside the bloc to so-called third countries which are not considered to have essentially equivalent privacy protections. Use of Google Analytics has now been found to breach European Union privacy laws in France - after a similar decision was reached in Austria last month.

Google data breach 2022