8 ms·

German company's use of Google Analytics breached GDPR

83 points by aliswe 5y ago

JackWritesCode 5y ago
Non-US companies must use a EU-owned servers (not just EU servers controlled by AWS, DigitalOcean) to process EU data subject traffic. If they don't, they're in violation of Schrems II, which makes them in violation of the GDPR.
- cayleyh 5y ago
  This doesn't seem consistent with the general Schrems II ruling (which was specifically about cross-border data transfer previously thought covered via EU-US Privacy Shield), and that AWS has specifically commented on https://aws.amazon.com/blogs/security/customer-update-aws-and-the-eu-us-privacy-shield/ https://aws.amazon.com/blogs/security/customer-update-aws-an... and https://aws.amazon.com/blogs/security/aws-and-eu-data-transfers-strengthened-commitments-to-protect-customer-data/ https://aws.amazon.com/blogs/security/aws-and-eu-data-transf.... Is there a specific ruling or case that says AWS as a provider, regardless of where the actual data processing happens, is prohibited, this out that you can point me to?
  - JackWritesCode 5y ago
    Yes, it dropped today: https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-... More EU member states will likely follow.
- estaseuropano 5y ago
  This summary makes it sound like a protectionist measure but that is not the design. The issue is just the US overreach in that the US expects any company to provide any data it holds, even if that data is stored outside the US, owned by a subsidiary, etc. EU (or Canadian, Russian, Kenyan, ...) data is simply not safe from US security services' reach if it is stored by a company subject to CLOUD. The court decision is only a consequence of this overreach and the EU's sovereign right and attempt to protect its citizens. This is even more relevant as US data protection seems to only apply to US subjects - so an American using an EU service using a US host would be protected by US law (in theory, though likely not in practice), while an EU citizen using the same EU service is not protected by US law.
V__ 5y ago
There are a lot of different viewpoints regarding GDPR. But the one thing which grinds my gears the most is the fact that somehow people using tools like Google Analytics take on legal risk, but not Google itself for providing it. Google has offices in Europe. Why, if it isn't possible to use it in compliance with the law (as a customer), isn't Google forced to shut it down or change it? The same goes for Facebook and all other companies offering tracking etc. They should be responsible for offering compliant products.
- HPsquared 5y ago
  If I was defending them, I'd use an argument along the lines of "trackers don't track people". In other words, "improper" use of the tools is the crime, not the creation of the tools themselves.
  - V__ 5y ago
    The thing about GDPR is, the intention (in most cases) doesn't matter. If Google is using servers outside Europe or using the data for anything not officially disclosed (and disclosures hidden in eulas etc. don't count) then they are in breach of GDPR.
    - j_not_j 5y ago
      Nah, I don't think so. Google is a subcontractor. The owner of the website is using a service to track browser behaviour, and, perhaps erroneously, user identities. The service is famous, but not unique. What the subcontractor does with the data is the responsibility of the website owner -- if they allow Google to abuse the data owner (that is, misuse the PII of people visiting the website), then the website owner should be held responsible.
      - V__ 5y ago
        > What the subcontractor does with the data is the responsibility of the website owner That's my issue. Since Google has legal entities in Europe they should be held accountable as well. Right now they are offering and marketing a service which is more or less illegal to use. If it were some company outside Europe, then yes by all means the website owner should make sure the 'subcontractor' is in compliance.
hobo_mark 5y ago
> companies can't use US cloud services in Europe anymore Wait sorry what? How does that even work?
- cassianoleal 5y ago
  This is very badly worded. What they probably mean is that European companies cannot use cloud services hosted in the US anymore. This is still a generalisation, since they can -- as long as no PII or otherwise GDPR-protected data is sent overseas. The most likely outcome is that Google will start offering EU-hosted GA as an opt-in. How much that will affect their global data collection and processing I don't know, but I suspect it will still be far less than if all EU services stopped using them altogether. Edit: I may be wrong. See lmkg's response in the thread.
  - sebazzz 5y ago
    > What they probably mean is that European companies cannot use cloud services hosted in the US anymore. Or more specifically: That companies who target EU citizens (whether that is private use or a person being employee of a company - it does not matter) cannot use cloud services hosted in the US, when saving PII to said service. It really doesn't matter whether you are based in Europe or not. Sendgrid for instance is an American company, but still has to follow the GDPR.
  - lmkg 5y ago
    A recent ruling about Cookiebot and their use of Akamai indicates that even EU-located servers run by a US company run afoul of GDPR. The core issue is that the US CLOUD Act gives US law enforcement access to data on those servers.
    - cassianoleal 5y ago
      Huh, interesting. Thanks for the info. Do you have any links to this?
      - 5y ago
TekMol 5y ago
What will happen to the European internet now? Pretty much every website in Europe uses Google Analytics. Next round Google Adsense? What will the European free web look like if it cannot be monetized anymore? Also, isn't the article somewhat strange? It is about a ruling but does not link to it or even gives any clue how they found it and how the reader can find it?
- david_draco 5y ago
  Why do you consider Google Adsense&Analytics the only possibility for monitization?
  - TekMol 5y ago
    When we look at publishers who publish in English for the whole world, the situation is like this: Adsense pays low and has ok protection from malicious ads. All other players I know pay even lower and feature more aggressive/malicious ads. While also being in the USA and having even more questionable data handling. If the European free and English internet turns of adsense right now, many of these publishers are bankrupt in that very moment.
    - nicbou 5y ago
      Ads are less and less common for monetisation. Most websites have switched to some form of affiliate marketing.
      - cblconfederate 5y ago
        Citation needed i think, especially for european sites.
  - deleted 5y ago
    [deleted]
- Bayart 5y ago
  I don't see how a web that depends on advertising and the whims of foreign megacorps is « free ». If anything it leads to lower standards of free speech and discourse.
lmkg 5y ago
I have some professional expertise in both Google Analytics and data privacy. The headlines always mention GDPR alone. I think it's more accurate to say that there are two laws which are incompatible: GDPR in Europe, and the CLOUD Act in the United States. GDPR allows data to be transferred to other countries. There are a number of other countries where it can be transferred without restrictions, beyond needing to notify users that a transfer exists (you don't even need to name the specific country!). Such countries include the UK, Japan, South Korea, and Argentina. Every court ruling that I've seen stemming from Schrems II focuses almost exclusively on the CLOUD Act. The US has, intentionally and explicitly, made it easy for law enforcement to access personal data stored by a US company. Like, literally the reason why this law exists is because one time Microsoft didn't hand over data to the FBI because it was stored in Ireland. The problem that it was written to solve was European data protection laws. Personally I think the CLOUD Act is more to blame for this situation, and the law that I would rather have changed.
- aliswe 5y ago
  if you opt out of tracking, would it be OK to have GA (which in any case only registers aggregate anonymous data) with storageless mode and anonymized IP?
  - lmkg 5y ago
    The data stored by Google Analytics is most definitely not aggregated. Go into the User Explorer report (under "Audience): you will be able to trace the individual interactions of each visitor to your site. GDPR considers this data be pseudonymous, which is distinct from anonymous. The ePD (a different EU data privacy law) requires IP anonymization. That feature is necessary, but not sufficient, to comply with the ePD. The ePD is a whole ball of worms in its own right, and I have a lower opinion of its value than I do of GDPR. I'm not sure whether those features are sufficient for GDPR and international transfers, though. The issue is that IP address is still received by Google servers, even if it's deleted right afterwards, so a transfer still takes place. But it might be possible to make that a compliant transfer if you sign SCCs with Google (I can't figure out if they offer this for Analytics!), and implement "additional safeguards." There's an argument that IP anonymization would constitute sufficient safeguards in the absence of other identifiers, but that's beyond my expertise.
aliswe 5y ago
Would it have helped with the "storageless" mode you can activate with GA? And IP anonymization? The article states: > The configuration error in connection with the IP anonymisation function was also corrected and Google confirmed the personal data had been deleted. However, the authority said in its decision that the IP address is "in any case only one of many 'puzzle pieces' of the complainant's digital footprint."
gingerlime 5y ago
I'm not sure I understand what's happening here. If they sent the IP address (by mistake), I guess that's a violation irrespective if it's in the EU or the US? Does this mean that an EU company can no longer host their main app with Google Cloud, AWS, DigitalOcean, Linode etc, even if the servers the EU? disclaimer: I donated to NOYB and worked with them on a complaint. I definitely support their cause. However, I also run a small bootstrapped digital business in the EU and complying with all regulations can become increasingly difficult...
- AlanYx 5y ago
  The position of Schrems/NOYB, as far as I understand it, is that using a cloud service potentially subject to US law, irrespective of where the servers are actually located, is inconsistent with the GDPR. He basically says the same thing in the linked article: "The bottom line is: companies can't use US cloud services in Europe anymore. It has now been 1.5 years since the Court of Justice confirmed this a second time, so it is more than time that the law is also enforced."
  - gingerlime 5y ago
    I understand they take a strong stance, but this does feel quite limiting if the expectation excludes nearly all cloud service providers… not even talking about analytics but just VPS hosting, database, CDNs etc
  - deleted 5y ago
    [deleted]
- deleted 5y ago
  [deleted]
huksley 5y ago
Can EU companies use AWS or Google Cloud in Ireland or it is also falls under US CLOUD Act?
cblconfederate 5y ago
Fun fact, a few weeks ago we were asked by the reviewer of the (EU-funded) H2020 research project in which we participate to add google analytics and twitter to our website so we can give her stats about our website visitors. Even despite our protest she insisted. People need to stop seeing the EU as some kind of pinnacle of rationality, GDPR is an unworkable implementation of wishful thinking that will be obsoleted by technology (which can already perform the same amount of tracking with AI and side channels).

83 points by aliswe 5y ago

Non-US companies must use a EU-owned servers (not just EU servers controlled by AWS, DigitalOcean) to process EU data subject traffic. If they don't, they're in violation of Schrems II, which makes them in violation of the GDPR.

cayleyh 5y ago
This doesn't seem consistent with the general Schrems II ruling (which was specifically about cross-border data transfer previously thought covered via EU-US Privacy Shield), and that AWS has specifically commented on https://aws.amazon.com/blogs/security/customer-update-aws-and-the-eu-us-privacy-shield/ https://aws.amazon.com/blogs/security/customer-update-aws-an... and https://aws.amazon.com/blogs/security/aws-and-eu-data-transfers-strengthened-commitments-to-protect-customer-data/ https://aws.amazon.com/blogs/security/aws-and-eu-data-transf.... Is there a specific ruling or case that says AWS as a provider, regardless of where the actual data processing happens, is prohibited, this out that you can point me to?
- JackWritesCode 5y ago
  Yes, it dropped today: https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-... More EU member states will likely follow.
estaseuropano 5y ago
This summary makes it sound like a protectionist measure but that is not the design. The issue is just the US overreach in that the US expects any company to provide any data it holds, even if that data is stored outside the US, owned by a subsidiary, etc. EU (or Canadian, Russian, Kenyan, ...) data is simply not safe from US security services' reach if it is stored by a company subject to CLOUD. The court decision is only a consequence of this overreach and the EU's sovereign right and attempt to protect its citizens. This is even more relevant as US data protection seems to only apply to US subjects - so an American using an EU service using a US host would be protected by US law (in theory, though likely not in practice), while an EU citizen using the same EU service is not protected by US law.

V__ 5y ago

There are a lot of different viewpoints regarding GDPR. But the one thing which grinds my gears the most is the fact that somehow people using tools like Google Analytics take on legal risk, but not Google itself for providing it. Google has offices in Europe. Why, if it isn't possible to use it in compliance with the law (as a customer), isn't Google forced to shut it down or change it? The same goes for Facebook and all other companies offering tracking etc. They should be responsible for offering compliant products.

HPsquared 5y ago
If I was defending them, I'd use an argument along the lines of "trackers don't track people". In other words, "improper" use of the tools is the crime, not the creation of the tools themselves.
- V__ 5y ago
  The thing about GDPR is, the intention (in most cases) doesn't matter. If Google is using servers outside Europe or using the data for anything not officially disclosed (and disclosures hidden in eulas etc. don't count) then they are in breach of GDPR.
  - j_not_j 5y ago
    Nah, I don't think so. Google is a subcontractor. The owner of the website is using a service to track browser behaviour, and, perhaps erroneously, user identities. The service is famous, but not unique. What the subcontractor does with the data is the responsibility of the website owner -- if they allow Google to abuse the data owner (that is, misuse the PII of people visiting the website), then the website owner should be held responsible.
    - V__ 5y ago
      > What the subcontractor does with the data is the responsibility of the website owner That's my issue. Since Google has legal entities in Europe they should be held accountable as well. Right now they are offering and marketing a service which is more or less illegal to use. If it were some company outside Europe, then yes by all means the website owner should make sure the 'subcontractor' is in compliance.

hobo_mark 5y ago

> companies can't use US cloud services in Europe anymore Wait sorry what? How does that even work?

cassianoleal 5y ago
This is very badly worded. What they probably mean is that European companies cannot use cloud services hosted in the US anymore. This is still a generalisation, since they can -- as long as no PII or otherwise GDPR-protected data is sent overseas. The most likely outcome is that Google will start offering EU-hosted GA as an opt-in. How much that will affect their global data collection and processing I don't know, but I suspect it will still be far less than if all EU services stopped using them altogether. Edit: I may be wrong. See lmkg's response in the thread.
- sebazzz 5y ago
  > What they probably mean is that European companies cannot use cloud services hosted in the US anymore. Or more specifically: That companies who target EU citizens (whether that is private use or a person being employee of a company - it does not matter) cannot use cloud services hosted in the US, when saving PII to said service. It really doesn't matter whether you are based in Europe or not. Sendgrid for instance is an American company, but still has to follow the GDPR.
- lmkg 5y ago
  A recent ruling about Cookiebot and their use of Akamai indicates that even EU-located servers run by a US company run afoul of GDPR. The core issue is that the US CLOUD Act gives US law enforcement access to data on those servers.
  - cassianoleal 5y ago
    Huh, interesting. Thanks for the info. Do you have any links to this?
    - 5y ago

TekMol 5y ago

What will happen to the European internet now? Pretty much every website in Europe uses Google Analytics. Next round Google Adsense? What will the European free web look like if it cannot be monetized anymore? Also, isn't the article somewhat strange? It is about a ruling but does not link to it or even gives any clue how they found it and how the reader can find it?

david_draco 5y ago
Why do you consider Google Adsense&Analytics the only possibility for monitization?
- TekMol 5y ago
  When we look at publishers who publish in English for the whole world, the situation is like this: Adsense pays low and has ok protection from malicious ads. All other players I know pay even lower and feature more aggressive/malicious ads. While also being in the USA and having even more questionable data handling. If the European free and English internet turns of adsense right now, many of these publishers are bankrupt in that very moment.
  - nicbou 5y ago
    Ads are less and less common for monetisation. Most websites have switched to some form of affiliate marketing.
    - cblconfederate 5y ago
      Citation needed i think, especially for european sites.
- deleted 5y ago
  [deleted]
Bayart 5y ago
I don't see how a web that depends on advertising and the whims of foreign megacorps is « free ». If anything it leads to lower standards of free speech and discourse.

lmkg 5y ago

I have some professional expertise in both Google Analytics and data privacy. The headlines always mention GDPR alone. I think it's more accurate to say that there are two laws which are incompatible: GDPR in Europe, and the CLOUD Act in the United States. GDPR allows data to be transferred to other countries. There are a number of other countries where it can be transferred without restrictions, beyond needing to notify users that a transfer exists (you don't even need to name the specific country!). Such countries include the UK, Japan, South Korea, and Argentina. Every court ruling that I've seen stemming from Schrems II focuses almost exclusively on the CLOUD Act. The US has, intentionally and explicitly, made it easy for law enforcement to access personal data stored by a US company. Like, literally the reason why this law exists is because one time Microsoft didn't hand over data to the FBI because it was stored in Ireland. The problem that it was written to solve was European data protection laws. Personally I think the CLOUD Act is more to blame for this situation, and the law that I would rather have changed.

aliswe 5y ago
if you opt out of tracking, would it be OK to have GA (which in any case only registers aggregate anonymous data) with storageless mode and anonymized IP?
- lmkg 5y ago
  The data stored by Google Analytics is most definitely not aggregated. Go into the User Explorer report (under "Audience): you will be able to trace the individual interactions of each visitor to your site. GDPR considers this data be pseudonymous, which is distinct from anonymous. The ePD (a different EU data privacy law) requires IP anonymization. That feature is necessary, but not sufficient, to comply with the ePD. The ePD is a whole ball of worms in its own right, and I have a lower opinion of its value than I do of GDPR. I'm not sure whether those features are sufficient for GDPR and international transfers, though. The issue is that IP address is still received by Google servers, even if it's deleted right afterwards, so a transfer still takes place. But it might be possible to make that a compliant transfer if you sign SCCs with Google (I can't figure out if they offer this for Analytics!), and implement "additional safeguards." There's an argument that IP anonymization would constitute sufficient safeguards in the absence of other identifiers, but that's beyond my expertise.

aliswe 5y ago

Would it have helped with the "storageless" mode you can activate with GA? And IP anonymization? The article states: > The configuration error in connection with the IP anonymisation function was also corrected and Google confirmed the personal data had been deleted. However, the authority said in its decision that the IP address is "in any case only one of many 'puzzle pieces' of the complainant's digital footprint."

gingerlime 5y ago

I'm not sure I understand what's happening here. If they sent the IP address (by mistake), I guess that's a violation irrespective if it's in the EU or the US? Does this mean that an EU company can no longer host their main app with Google Cloud, AWS, DigitalOcean, Linode etc, even if the servers the EU? disclaimer: I donated to NOYB and worked with them on a complaint. I definitely support their cause. However, I also run a small bootstrapped digital business in the EU and complying with all regulations can become increasingly difficult...

AlanYx 5y ago
The position of Schrems/NOYB, as far as I understand it, is that using a cloud service potentially subject to US law, irrespective of where the servers are actually located, is inconsistent with the GDPR. He basically says the same thing in the linked article: "The bottom line is: companies can't use US cloud services in Europe anymore. It has now been 1.5 years since the Court of Justice confirmed this a second time, so it is more than time that the law is also enforced."
- gingerlime 5y ago
  I understand they take a strong stance, but this does feel quite limiting if the expectation excludes nearly all cloud service providers… not even talking about analytics but just VPS hosting, database, CDNs etc
- deleted 5y ago
  [deleted]
deleted 5y ago
[deleted]

huksley 5y ago

Can EU companies use AWS or Google Cloud in Ireland or it is also falls under US CLOUD Act?

cblconfederate 5y ago

Fun fact, a few weeks ago we were asked by the reviewer of the (EU-funded) H2020 research project in which we participate to add google analytics and twitter to our website so we can give her stats about our website visitors. Even despite our protest she insisted. People need to stop seeing the EU as some kind of pinnacle of rationality, GDPR is an unworkable implementation of wishful thinking that will be obsoleted by technology (which can already perform the same amount of tracking with AI and side channels).