4 ms·

To be clear, the transfer of EU citizen's data to the US was deemed against the GDPR. This decision does not mean that Google Analytics itself is illegal.

darkwater 5y ago
I think the syllogism comes from the fact that currently GA does transfer EU data to the US by default (and probably currently there is no way to prevent that?). But I'm not a GA expert at any rate so I can be totally wrong.
- smoe 5y ago
  As I understood it, data location is not even the problem, but the US CLOUD Act, that allows their authorities to request data from US companies no matter where it is stored. So even if Google Analytics would store data from EU citizens in Europe, they would still violate GDPR, because US authorities can access the data without the users consent.
  - jusssi 5y ago
    So they set up an EU subsidiary that's independent enough for CLOUD Act to not apply. Problem solved.
    - krageon 5y ago
      > for CLOUD Act to not apply If there is oversight from the US (i.e. it is still the owner), this is not possible.
      - geewee 5y ago
        Nope. I've heard some people talk about company constructions where you create a new officially unaffiliated company in the EU, that then just lends the IP to create a datacenter from the US-based companies, but I'm not sure if that's actually feasible.
        jeroenhd 5y ago
        If that company is entirely separate (but happens to have the same investors) and no more money flows between them than the cost of IP, then that may just work. You'll have to be careful not to let shares fall into the wrong hands, though because the two companies might eventually grow apart as a result of having different shareholders with different opinions. Such a move might also be frowned upon by the American government, because you're essentially cutting them off from part of your company. I think this concept would work from an EU standpoint, but it wouldn't surprise me if the US government would prevent you from doing that, or even hold you personally accountable. You'd also need to get a pretty good analysis of tax laws because suddenly the top owner of the company isn't foreign to the EU anymore, and that could be a problem for the tax evasion schemes big tech is such a fond of. All in all, I doubt it's worth the hassle. As a customer of Google Analytics you'd need to have some logic to load either the European or the global analytics script, and the data cannot be combined into one overview without stripping a lot of important context (or breaking the law in the same way).
        geewee 5y ago
        Yeah but I think this goes bigger than this. We might see Google Analytics now, but we're going to end up seeing problems with European companies using AWS, Azure etc. later on. _That_ might be big enough to warrant it.
        krageon 5y ago
        In practice this construction does not exist for the big tech conglomerates. Perhaps they will exist one day, but I doubt it. These companies are fundamentally imperialistic artifacts and this proposed solution is about relinquishing control over a foreign asset: It does not mesh with their core culture.
brnt 5y ago
But, due to American intelligence agencies explicit access to overseas data (Schrems II), any such service by an American company can't meet the requirements set forth by the EU, and thus can be considered illegal for any practical purpose.
- bryanrasmussen 5y ago
  As I understand the ruling though this pertains to the fact that data is transferred to the U.S, it may be that if they changed to just using servers in the EU it would still be declared illegal but a new case would have to go through to make this declaration?
  - tremon 5y ago
    No, the CLOUD act was created specifically because Microsoft previously denied to comply with a US court order on the basis that the data was stored in Ireland. The US chose to compel a national company to produce the data instead of using an international data request, and as a result no US-based company can comply with the GDPR. https://cdt.org/insights/microsoft-ireland-case-can-a-us-warrant-compel-a-us-provider-to-disclose-data-stored-abroad/ https://cdt.org/insights/microsoft-ireland-case-can-a-us-war... https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_States#Supreme_Court https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_Stat...
    - bryanrasmussen 5y ago
      ah thanks, now I understand. Well looks like Google's screwed then.

darkwater 5y ago

I think the syllogism comes from the fact that currently GA does transfer EU data to the US by default (and probably currently there is no way to prevent that?). But I'm not a GA expert at any rate so I can be totally wrong.

smoe 5y ago
As I understood it, data location is not even the problem, but the US CLOUD Act, that allows their authorities to request data from US companies no matter where it is stored. So even if Google Analytics would store data from EU citizens in Europe, they would still violate GDPR, because US authorities can access the data without the users consent.
- jusssi 5y ago
  So they set up an EU subsidiary that's independent enough for CLOUD Act to not apply. Problem solved.
  - krageon 5y ago
    > for CLOUD Act to not apply If there is oversight from the US (i.e. it is still the owner), this is not possible.
    - geewee 5y ago
      Nope. I've heard some people talk about company constructions where you create a new officially unaffiliated company in the EU, that then just lends the IP to create a datacenter from the US-based companies, but I'm not sure if that's actually feasible.
      - jeroenhd 5y ago
        If that company is entirely separate (but happens to have the same investors) and no more money flows between them than the cost of IP, then that may just work. You'll have to be careful not to let shares fall into the wrong hands, though because the two companies might eventually grow apart as a result of having different shareholders with different opinions. Such a move might also be frowned upon by the American government, because you're essentially cutting them off from part of your company. I think this concept would work from an EU standpoint, but it wouldn't surprise me if the US government would prevent you from doing that, or even hold you personally accountable. You'd also need to get a pretty good analysis of tax laws because suddenly the top owner of the company isn't foreign to the EU anymore, and that could be a problem for the tax evasion schemes big tech is such a fond of. All in all, I doubt it's worth the hassle. As a customer of Google Analytics you'd need to have some logic to load either the European or the global analytics script, and the data cannot be combined into one overview without stripping a lot of important context (or breaking the law in the same way).
        geewee 5y ago
        Yeah but I think this goes bigger than this. We might see Google Analytics now, but we're going to end up seeing problems with European companies using AWS, Azure etc. later on. _That_ might be big enough to warrant it.
      - krageon 5y ago
        In practice this construction does not exist for the big tech conglomerates. Perhaps they will exist one day, but I doubt it. These companies are fundamentally imperialistic artifacts and this proposed solution is about relinquishing control over a foreign asset: It does not mesh with their core culture.

brnt 5y ago

But, due to American intelligence agencies explicit access to overseas data (Schrems II), any such service by an American company can't meet the requirements set forth by the EU, and thus can be considered illegal for any practical purpose.

bryanrasmussen 5y ago
As I understand the ruling though this pertains to the fact that data is transferred to the U.S, it may be that if they changed to just using servers in the EU it would still be declared illegal but a new case would have to go through to make this declaration?
- tremon 5y ago
  No, the CLOUD act was created specifically because Microsoft previously denied to comply with a US court order on the basis that the data was stored in Ireland. The US chose to compel a national company to produce the data instead of using an international data request, and as a result no US-based company can comply with the GDPR. https://cdt.org/insights/microsoft-ireland-case-can-a-us-warrant-compel-a-us-provider-to-disclose-data-stored-abroad/ https://cdt.org/insights/microsoft-ireland-case-can-a-us-war... https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_States#Supreme_Court https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_Stat...
  - bryanrasmussen 5y ago
    ah thanks, now I understand. Well looks like Google's screwed then.