William Gallagher
A French company has been ordered to cease using Google Analytics as authorities say there is a GDPR "risk" that US intelligence services may access the data.
France's data protection authority, which has previously said Apple advertising may contravene GDPR laws, has now concluded that accessing Google Analytics definitely does. Citing the EU's General Data Protection Regulation, it as ordered at least one French firm to cease using the Google service.
According to Le Monde, the National Commission for Informatics and Liberties (CNIL) has issued a formal statement regarding the unnamed company. "The site manager has one month to comply," says the statement (in translation), as seen by Le Monde.
"The CNIL notes that Internet users' data [collected by Google Analytics] are transferred to the United States in violation of...GDPR," continues the statement. "It therefore requires the site manager to bring these processing into compliance with the GDPR, if necessary by ceasing to use the Google Analytics feature (under current conditions) or by using a tool that does not result in a transfer outside the EU."
Europe enacted GDPR in 2018, but Le Monde says that the new move against an unknown number of firms is based on a July 2020 case. Known as the "Schrems II" judgment, the Court of Justice of the European Union's decision affects any transfer of data outside the EU.
CNIL says that this judgement "highlighted the risk that American intelligence services will access the personal data transferred to the United States," or at least could "if the transfers were not properly regulated."
Google has not commented on the CNIL decision. However, its support pages acknowledge that by default, Google Analytics is not GDPR-compliant. However, the same pages offer a series of options to help users comply with the regulation.
Those moves now do not appear to have satisfied the CNIL.
"While Google has adopted additional measures to regulate data transfers under the Google Analytics feature," continues the CNIL statement, "these are not enough to exclude the possibility [of US intelligence access]."
Wesley Hilliard
Malcolm Owen
Andrew Orr
Sponsored Content
Christine McKee
Thomas Sibilly
6 Comments
This is rich. Everybody on the planet knows that governments spy on each other, even among allies. When the spying is uncovered feathers get ruffled, denials are made, protests are issued, ambassadors get recalled for a few days, and everything returns to normal. The spying goes on.
What is really the point? If the main concern here is possible data interception by US Intelligence does the French government really think that if the data is housed in Europe and the US government wants that data the NSA won’t find a way to access it? This is the organization that managed to wiretap European leaders in their own countries. Getting some analytics data from a server in the EU would be child’s play.
Without a new "Privacy Shield" Google Analytics is not compliant with the GDPR, the CNIL is enforcing that fact. That's all, there is no political biais.