Security News > 2023 > July > Google Analytics data transfer to U.S. brings $1 million fine to Swedish firms
In a decision published yesterday, the agency explains that by using Google Analytics to generate web statistics the firms were breaching European Union's General Data Protection Regulation.
The United States has been deemed as a risky location for the storage of data of European users, as per the July 2020 "Schrems II" judgment, where the Court of Justice of the European Union ruled that any data transfers to the U.S. in the context of the then-existing mechanism, "Privacy Shield," were illegal.
This violation is the same for which the Irish Data Protection Commission fined Meta $1.3 billion for transferring EU-based user data to servers in the U.S. IMY, following the submission of a relevant complaint by the Austrian digital rights organization None of Your Business, carried out audits to determine the type of data the Google Analytics tool sends in the U.S. and concluded that it constitutes personal information.
"IMY considers that the data transferred to the U.S. via Google's statistics tool is personal data because the data can be linked with other unique data that is transferred," states.
The other three organizations are ordered to stop using Google Analytics and to implement adequate data protection measures no later than one month after IMY's decision, which was announced on June 30, 2023.
The use of Google Analytics has been deemed non-GDPR-compliant again in the past by the data protection authorities in Austria, France, and Italy.