A French company has been ordered to cease using Google Analytics as authorities say there is a GDPR "risk" that US intelligence services may access the data.
France's data protection authority, which has previously said Apple advertising may contravene GDPR laws, has now concluded that accessing Google Analytics definitely does. Citing the EU's General Data Protection Regulation, it as ordered at least one French firm to cease using the Google service.
According to Le Monde, the National Commission for Informatics and Liberties (CNIL) has issued a formal statement regarding the unnamed company. "The site manager has one month to comply," says the statement (in translation), as seen by Le Monde.
"The CNIL notes that Internet users' data [collected by Google Analytics] are transferred to the United States in violation of...GDPR," continues the statement. "It therefore requires the site manager to bring these processing into compliance with the GDPR, if necessary by ceasing to use the Google Analytics feature (under current conditions) or by using a tool that does not result in a transfer outside the EU."
Europe enacted GDPR in 2018, but Le Monde says that the new move against an unknown number of firms is based on a July 2020 case. Known as the "Schrems II" judgment, the Court of Justice of the European Union's decision affects any transfer of data outside the EU.
CNIL says that this judgement "highlighted the risk that American intelligence services will access the personal data transferred to the United States," or at least could "if the transfers were not properly regulated."
Google has not commented on the CNIL decision. However, its support pages acknowledge that by default, Google Analytics is not GDPR-compliant. However, the same pages offer a series of options to help users comply with the regulation.
Those moves now do not appear to have satisfied the CNIL.
"While Google has adopted additional measures to regulate data transfers under the Google Analytics feature," continues the CNIL statement, "these are not enough to exclude the possibility [of US intelligence access]."