Security News > 2022 > January > Austrian watchdog rules German company's use of Google Analytics breached GDPR by sending data to US

The Austrian data protection authority has ruled that use of Google Analytics by a German company is in breach of European law in light of the Schrems II EU-US data sharing ruling.

Datenschutzbehörde, or DSB, has found that a German publisher, not named in the case, was in breach of Article 44 of the General Data Protection Regulation in the use and operation of Google Analytics - commonly used throughout web publishing and ecommerce - because of its movement of personal data to the United States.

The site contained embedded HTML code for Google services, including Google Analytics.

The data had been transferred to Google, putting them under the purview of GDPR. DSB found the publisher had been responsible for the sharing of data in its use of Google Analytics and that standard data protection clauses did not provide adequate levels of protection under GDPR because Google can be subject to surveillance by US intelligence agencies under so-called FISA 702 rules.

During the case, the publisher instructed Google to immediately delete all data collected via the Google Analytics properties.

In a statement, a Google spokesperson said: "People want the websites they visit to be well designed, easy to use, and respectful of their privacy. Google Analytics helps retailers, governments, NGOs and many other organizations understand how well their sites and apps are working for their visitors - but not by identifying individuals or tracking them across the web. These organisations, not Google, control what data is collected with these tools, and how it is used. Google helps by providing a range of safeguards, controls and resources for compliance." .

News URL

https://go.theregister.com/feed/www.theregister.com/2022/01/13/google_analytics_gdpr/