Google Analytics is under fire in the EU. The market leader in web analytics services faces a troubling outlook following a ground-breaking decision by the Austrian and three more decisions by the French data protection authorities (DPA) declaring the use of Google Analytics incompatible with the EU General Data Protection Regulation (GDPR). The digital rights NGO noyb had issued 101 complaints against websites across the EU in an effort to prompt data protection authorities to enforce rules which prohibit the transfer of personal data into countries with substantially lower data protection standards than in the EU. With similar complaints pending in nearly all other EU member states, other DPAs are likely to issue decisions in line with their French and Austrian counterparts.
The root of all this trouble is the ‘Schrems II’ ruling of the Court of Justice of the European Union (CJEU) from 16 July 2020. The Court declared the EU-US Privacy Shield on which many EU-US data transfers relied for legitimacy invalid due US laws granting intelligence services unproportionate access to the data of EU citizens upon transfer to the US. The judgement succeeded the similar challenge of ‘Schrems I’ that had struck down the Safe Harbour agreement which had fulfilled the same purpose of legitimising data transfers to the US.
So does all this mean the end for Google Analytics in the EU market? Not necessarily. Google could potentially restore compliance by storing data gathered by Google Analytics on servers located physically within the EU. It could also modify the service so that only anonymised data which escapes the scope of the GDPR is transferred into the US.
Furthermore, the US and the EU Commission announced in March 2022 that they had reached agreement on a new data transfer deal that would reinstate legal certainty for businesses wanting to transfer data of EU citizens to the US. However, as of right now the details of the new deal are yet to be released. This leaves some wondering whether the rules will be able to live up to the tough standards set by the CJEU. A document published by the US government promised safeguards such as an independent redress mechanism for EU citizens. Nevertheless, Max Schrems – founder of noyb – raised a note of caution, saying that his NGO was ready to challenge any new deal within months should it not comply fully with EU fundamental rights.
All this is wind in the sails of EU-based providers of web analytics services that have long struggled to challenge Google’s dominant position. With website owners now risking fines for the continued use of Google Analytics, this may open a window of opportunity for competitors that use GDPR-compliance as one of their central selling points.
One may think that this is an awful lot of fuzz over something like web analytics. However, the debate is reflective of the more fundamental issue of EU-US data transfers in general. In our digitalised economy this affects services provided by all major US tech companies, including Meta, Amazon, Apple and Microsoft. Their cloud business and other services - on which vast proportions of the EU economy rely - all are set for turbulent times as they find themselves at the centre of the EU’s fight for digital sovereignty.
Commentaires