Google Analytics and the GDPR
The use of Google Analytics contradicts the GDPR!
Recently, the Data Protection Authority (DPA) declared in a landmark decision that the integration of Google Analytics into websites violates the General Data Protection Regulation. This effectively puts a stop to the use of this popular analytics tool and leaves its users in the dark. Our data protection expert Thomas Riesz has already been interviewed by the daily newspaper Die Presse on this controversial decision.
What does the DPA consider incompatible with the GDPR?
When using Google Analytics, the unique identification number created by default on the website user’s browser is transmitted to Google. This and other data transmitted to Google, such as the IP address, can be traced back to the website user by the internet giant. Ultimately, this means that personal data is transmitted to the USA. However, according to the GDPR, this is only permissible if there is an appropriate level of protection for the processing of the personal data of EU citizens there.
With the ruling of the ECJ in the Schrems II case, the so-called Privacy Shield ceased to serve as the legal basis for data transfer to the USA. With the current decision, the DPA has made it clear that the mere adoption of the standard protection clauses drawn up by the EU Commission between Google and the website operators does not provide a sufficient legal basis for the data transfer to the USA. With the possibility of US authorities being able to access the website user’s data transmitted to Google, the appropriate level of protection required by the GDPR is not achieved.
What does this mean for those who use Google Analytics for their websites?
Since the previous use runs the risk of being sanctioned by the DPA, there is a need for immediate action. Either technical measures must be taken that exclude a data transfer of personal data or a use of Google Analytics that is as legally unassailable as possible has to be implemented.
This article is for general information only and does not replace legal advice. Haslinger / Nagele Rechtsanwälte GmbH assumes no liability for the content and correctness of this article.
25. January 2022
Go back to News