Digital Law Up(to)date: The use of the free version of Google Analytics violates the GDPR

The decision of 22 December 2021 (available in German with a machine translation in English, here) is the first decision on the 101 complaints on EU-US data transfers filed by Noyb (see here), the association of Max Schrems, in the wake of the decision “Schrems II” of the Court of Justice of the European Union (see here).

Firstly, the Austrian DPA considered that the website operators using Google Analytics are to be considered as data controllers and that Google is to be considered as processor. Standard Contractual Clauses (SCCs) and some additional measures furthermore framed the export of personal data to the United States.  

But, the main issue is that Google processes data from Google Analytics on American servers. According to the US law, Google is an “electronic communications service provider”. In practice, this means among other that US intelligence services can have access to these European Data. The Austrian DPA therefore considered that the level of protection of the European Data was not sufficient. 

As mentioned above, Noyb filed in 2020 101 complaints in European States. will be very interesting to see how the other national Data Protection Authorities position themselves. It is clear that the Austrian decision is an important precedent. For example, the Dutch DPA has already modify a question on its website on the use of Google Analytics. It states that the use of Google Analytics may not be permitted soon (with a reference to the Austrian decision) and that there is currently investigation about two complaints about the use of Google Analytics in the Netherlands (see here).

This article was co-authored by Edouard Cruysmans in his capacity of Professional Support Lawyer at Stibbe.