4 ms·
I have some professional expertise in both Google Analytics and data privacy. The headlines always mention GDPR alone. I think it's more accurate to say that t
by lmkg 5y ago
I have some professional expertise in both Google Analytics and data privacy.
The headlines always mention GDPR alone. I think it's more accurate to say that there are two laws which are incompatible: GDPR in Europe, and the CLOUD Act in the United States.
GDPR allows data to be transferred to other countries. There are a number of other countries where it can be transferred without restrictions, beyond needing to notify users that a transfer exists (you don't even need to name the specific country!). Such countries include the UK, Japan, South Korea, and Argentina.
Every court ruling that I've seen stemming from Schrems II focuses almost exclusively on the CLOUD Act. The US has, intentionally and explicitly, made it easy for law enforcement to access personal data stored by a US company. Like, literally the reason why this law exists is because one time Microsoft didn't hand over data to the FBI because it was stored in Ireland. The problem that it was written to solve was European data protection laws.
Personally I think the CLOUD Act is more to blame for this situation, and the law that I would rather have changed.
- aliswe 5y agoif you opt out of tracking, would it be OK to have GA (which in any case only registers aggregate anonymous data) with storageless mode and anonymized IP?
- lmkg 5y agoThe data stored by Google Analytics is most definitely not aggregated. Go into the User Explorer report (under "Audience): you will be able to trace the individual interactions of each visitor to your site. GDPR considers this data be pseudonymous, which is distinct from anonymous. The ePD (a different EU data privacy law) requires IP anonymization. That feature is necessary, but not sufficient, to comply with the ePD. The ePD is a whole ball of worms in its own right, and I have a lower opinion of its value than I do of GDPR. I'm not sure whether those features are sufficient for GDPR and international transfers, though. The issue is that IP address is still received by Google servers, even if it's deleted right afterwards, so a transfer still takes place. But it might be possible to make that a compliant transfer if you sign SCCs with Google (I can't figure out if they offer this for Analytics!), and implement "additional safeguards." There's an argument that IP anonymization would constitute sufficient safeguards in the absence of other identifiers, but that's beyond my expertise.
- aliswe 5y agook, thank you ..., but is it PII?
- victorbjorklund 5y ago> anonymized IP? The agency said that it doesn't matter because you send the IP to Google and after that Google anonymise the IP but sending the IP in the first place to Google is the violation so it doesn't matter that Google claims they will later remove it. I think the whole GDPR is just a mess so don't shoot the messenger.
- cassianoleal 5y ago> Such countries include the UK Is this because of UK GDPR? Since Brexit there have been pressures to change some parts of it. Could these changes take UK off this list?
- M2Ys4U 5y agoThe UK-EU withdrawal agreement included a transitionary adequacy agreement, in large part because the GDPR formed (and still does as the UK GDPR) part of UK law.