Europe’s opposition to Google Analytics is just the beginning

The agency’s decision said that because Google could access the data in plain text, it could not protect the data from potential surveillance. “Such transfers are considered illegal because there is not an adequate level of protection for the personal data transferred,” said Matthias Schmidl, deputy head of the Austrian data watchdog. He added that website operators cannot use Google Analytics and comply with the GDPR.

Currently, the decision applies only to Austria and is not final. Sites in Europe don’t suddenly stop using Google Analytics. NetDoktor did not respond to a request for comment. “While this decision directly affects only one specific publisher and its specific circumstances, it could portend broader challenges,” said Kent Walker, Google’s senior vice president of global affairs and chief legal officer.in a blog post Posted on January 19, Walker said, the company believes it takes technological steps to protect people’s data, and that such decisions could affect how data flows “throughout the European and American business ecosystem.”

And this is just the beginning. When noyb filed its case against NetDoktor in August 2020, it also filed 100 other cases against other European data protection authorities. “It’s not specific to Google Analytics. It’s basically about outsourcing to U.S. vendors,” Schrems said.

Regulators in 30 European countries are currently investigating other cases, including the use of Google Analytics and Facebook Connect, the company’s tool to link your account to other websites. Country-specific websites belonging to Airbnb, Sky, Ikea and The Huffington Post are also subject to complaints. “Most of these decisions will have the same or similar results,” Zanfir-Fortuna said. She said this was likely because the noyb used the same legal arguments in all of its cases, and in response the data protection watchdog set up a working group to discuss legal issues. “We hope this will mobilize country by country, wherever it falls,” Schrems said.

The Dutch data protection agency Autoriteit Persoonsgegevens said it was completing an investigation and did not rule out the possibility of using Google Analytics in its current form. In Germany, where data issues are regulated by the region, the data protection authority in Hamburg received two complaints from noyb and said in one case the site had removed Google Analytics, so in this case it “does not intend to issue any orders or fine”. It is still investigating another case.

Simon McGarr, head of European data compliance at McGarr Solicitors, said that despite the coordination among data regulators, there may still be some differences of opinion. “Austria’s position could be at one end of a range of views — it could represent the most radical end,” he said, adding that other data agencies either endorsed, modified or rejected this line of reasoning. Disagreements among the EU’s 27 GDPR enforcers are not uncommon: last year, Ireland’s data protection authority increased its fine on WhatsApp by 175 million euros after other regulators disagreed with the decision. McGarr said other EU regulators may draw different conclusions based on the facts of each case.