Because Google can access data in plain text, the data is not protected from potential surveillance, according to the agency’s decision. “This transfer is considered illegal because there is no adequate level of protection for the personal data transferred,” said Matthias Schmidl, deputy head of Austria’s data regulator. He adds that website operators cannot use Google Analytics and is GDPR compliant.
For now, the decision applies only in Austria and is not final. Websites across Europe won’t suddenly stop using Google Analytics. NetDoktor did not respond to a request for comment. “While this decision only directly affects a particular publisher and their specific circumstances, it can lead to greater challenges,” said Kent Walker, Senior Vice President of Operations global affairs and Google’s chief legal officer said. In a blog post published on January 19Walker said that the company believes the technical measures it has put in place protect people’s data, and that this kind of decision could impact how data flows across “the entire European business ecosystem.” and America”.
And this is just the beginning. When noyb filed a lawsuit against NetDoktor in August 2020, it also filed another 100 cases with other data protection authorities across Europe. “It is not specific to Google Analytics. It’s basically about outsourcing to US suppliers in general,” Schrems said.
Regulators in 30 European countries are currently investigating other cases, including the company’s use of Google Analytics and Facebook Connect, the company’s tool to link your account to other websites. The country-specific sites belonging to Airbnb, Sky, Ikea and The Huffington Post may also be subject to complaints. “Most of these decisions will have the same or similar outcome,” says Zanfir-Fortuna. She said this was possible because noyb used the same legal arguments for all of its cases and in response data protection regulators formed a task force to discuss legal issues. “We expect that this will mobilize country by country, wherever it falls,” said Schrems.
The Dutch data protection authority, Autoriteit Persoonsgegevens, said it was completing its investigation and did not rule out the possibility that the use of Google Analytics in its current form would be banned. In Germany, where data issues are regulated by region, Hamburg’s data protection authority received two complaints from noyb and said in one case the site had removed Google Analytics, so they “do not plan to issue any orders or fines” in this case. It’s still investigating the other case.
Simon McGarr, director of data compliance for McGarr Solicitors at McGarr Solicitors, said that despite the coordination of data regulators, there could be some differences of opinion. “Austrian position is probably at one end of a range of positions — and it would probably represent the most radical end,” he said, adding that other data agencies would agree, correcting change or refute that line of argument. Disagreements between the EU’s 27 GDPR enforcement agencies are not uncommon: Last year, the Irish Data Protection Authority fined WhatsApp an additional 175 million euros after other regulators disagreed with the decision. McGarr says it’s possible that other EU regulators looking at noyb cases could reach different conclusions based on the facts of each case.
