The Austrian Data Protection Authority ruled that the use of Google Analytics by a website owner violated Chapter V GDPR (transfers of personal data to third countries or international organisations).
Google Analytics is on the verge of an astounding avalanche of complaints lodged by NOYB1, the non-profit organization chaired by the Austrian activist and lawyer Maximilian Schrems. The first of these complaints has just been discussed2 by the Austrian Data Protection Authority (DSB), who ruled that the use of Google Analytics tool is unlawful. This decision has a far-reaching effect, as it represents the tangible consequence of the recent CJEU case Schrems II and the invalidation of the Privacy Shield. With only a few legal instruments available to controllers and processors3 in addition to the new versions of the SCCs, there is still plenty of room for a guidance on EU – US data transfers.
Amid 2020, the data subject visited a .at website managed by its Austrian owner (“Controller”). The latter implemented the Google Analytics service tool on its website. Google Analytics places cookies to measure traffic characteristics, including the behavior of website visitors and the offer of targeted advertising on the website. While surfing the website, the data subject was logged with his Google account. The log allowed Google LLC, vested as the processor (“Google”, or “Processor”), to view at least his IP address, unique user identification numbers and browser settings. Due to human factors, Controller did not activate the anonymization function on Google Analytics dashboard4. The said function masks the last three digits of the end-user IP address while leaving unmasked the so-called “device fingerprinting”56. This data is meant to be sufficient for Google to single-out the data subject. Both Controller and Processor entered into the former version of the SCCs7 in order to be able to transfer the data to the U.S..
Soon after becoming aware of the type of processing conducted by and on the behalf of the Controller, the data subject, represented by NOYB, lodged a complaint before the DSB, claiming that the transfer of personal data to Google was in violation of the GDPR and the Schrems II ruling8.
The claimant complained on the violation of Chapter V, Articles 44 et seq. GDPR9 in the light of Schrems II ruling. According to the fact Privacy Shield has been held invalid, the transfer could only be possible as far as essentially equivalent measures to the EU were also available in the U.S.. As if that were not enough, the data subject complained that, since Google is an electronic communication service provider under 50 U.S. Code § 1881(b)(4), it is subject to surveillance activities by U.S. intelligence services. Therefore Google can be “cracked” and disclose to the U.S. government the transferred personal data of EU residents10. In this regard, Google stated that additional technical and security measures were in place to handle the US government requests11. DSB did not consider such measures as essentially equivalent to those available in the EU.
Regardless of the additional measures implemented in addition to the SCCs, personal data collected through Google Analytics were potentially accessible by the U.S. intelligence. This was possible even in the case Google’s anonymization and pseudonymization means were available and functioning. If the data subject was logged with his Google account while surfing the web, it was Google that, regardless of the security measures applied12, had the means to reidentifying the individual13. As a consequence, it is not excluded that Google could single-out the data subject with reasonable effort at any rate. Mutatis mutandis, this is what Recital 26 GDPR suggests when it states that the question of whether a natural person is identifiable takes into account “[…] any means reasonably likely to be used by the controller or by any other person [Google LLC] to identify the natural person, directly or indirectly, such as singling out”14. With this in mind, it is difficult to imagine a threshold where the “reasonably likely” effort of a tech giant like Google eventually turns into a disproportionate effort to single out the data subject, especially in the case of a logged account.
DSB is consistent with this interpretation of the law, and confirms that, regardless the anonymization function available as an optional setting, its implementation would not have saved the Controller from violating the GDPR. DSB expressly mentions that
“The “anonymization function of the IP address” mentioned is not relevant in relation to the case, as this was not implemented correctly […].”15
DSB continues its reasoning by stating that
“[a]part from that, the IP address is in any case only one of many “puzzle pieces” of the complainant’s digital footprint.”
As with the “device fingerprinting”, the “digital footprint” allows to cross-check data in order to date back to the data subject and single him/her out. This is what Google’s proprietary technology is potentially capable of, and this, again, is the reason why the additional measures implemented to render Google Analytics GDPR compliant on behalf of the Controller are not sufficient to close the legal protection gaps identified in the context of the Schrems II decision. Speaking of which, DSB cites the EDPB recommendations 01/2020 (paragraph 70) as the interpretation key of the Schrems II case law as applied to the case:
“[a]ny supplementary measure may only be deemed effective in the meaning of the CJEU judgment “Schrems II” if and to the extent that it addresses the specific deficiencies identified in your assessment of the legal situation in the third country. If, ultimately, you cannot ensure an essentially equivalent level of protection, you must not transfer the personal data.”
This being said, at least at this point in time and according to the DSB, Google Analytics does not ensure a level of protection which is essentially equivalent to that of the EU.
In conclusion, after the Schrems II ruling16 and the invalidation of Privacy Shield, the EU – US approach to cross-border data transfers got harsher than before. As a matter of fact, Privacy Shield was the only guidance available to EU based businesses who wished to transfer personal data to the US. The invalidation of the Privacy Shield led to a clear fragmentation of approaches available to enact EU – US data transfers; it contributed, in part, to enhance the uncertainty behind the appropriate technical, organizational and security measures to adopt in such situations. It is needless to say that Schrems II decision has shed a light on the criticalities and incompatibilities between the access to data available to the US government agencies and the fundamental rights and freedoms enforced through the GDPR. Nevertheless, as far as a definition of appropriate and correct transatlantic transfer is concerned, neither the EU, nor, let alone, the US, have reached an even position.
Edoardo Di Maggio
1 Following Schrems II decision, NOYB lodged a total of 101 complaints in different jurisdictions, https://noyb.eu/en/eu-us-transfers-complaint-overview.
2 The fine is yet to be decided, and could go up to 20 million euros or 4% of turnover, whichever is higher.
3 Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data; Recommendations 02/2020 on the European Essential Guarantees for surveillance measures.
4 Datenschutzbehörde, Case: D155.027 2021-0.586.257, Reasons, A.7.
6 “[…] the combination of cookie data and IP address [that] allows tracking and the evaluation of geographical localization, Internet connection and context of the visitor, which can be linked [to an individual’s device] (emphasis added), ut supra, fn. 4, Reasons, A.10.
7 Standard Contractual Clauses pursuant to Commission Decision 2010/87 of 05.02.2010.
8 Ut Supra, fn. 4, Reasons, A.1.
9 Ibid.
10 Ibid.
11 Ut supra, fn. 4, D.3 Heading 2.b, letters e) and f).
12 Ut supra, fn. 4, Findings of fact, C.10, “for the determination of the facts, this accountability under data protection law means that the respondent (or, in any case, the first respondent as the responsible party) – and not the complainant or the data protection authority – must provide sufficient proof. Such sufficient proof – i.e., that from a technical point of view there is no possibility for the second respondent to obtain data – was not provided in this context, especially since it is precisely an essential part of the concept of Google Analytics to be implemented on as many websites as possible in order to be able to collect data”.
13 Ut supra, fn. 4, Findings of fact, C.10.
14 Emphasis added.
15 Ut supra, fn. 5, D.3 f).
16 Court of Justice of the European Union, Case C-11/18.
