5 ms·

As far as I understand it, it's not Google Analytics per se that is illegal, but the data transfer to the US. If Google Analytics would use servers on European

• sjogress 5y ago
  As far as I can tell this ruling means that transfering PII to any company/service controlled by an American company is illegal per the GDPR. I work for a European company that is already being impacted by this ruling. Our first step is to replace Google Analytics, but I believe we are also looking through all cloud usage for any traces of PII. I think this is a huge opportunity for European companies to get a foothold in the Analytics/Ads/Cloud/Office spaces. Perhaps also an opportunity for good open source alternatives, like Matomo Analytics, to get adopted.
• toyg 5y ago
  The various shields for EU->US datatransfer, agreed before and after GDPR, have been found incompatible with GDPR even if only potential. It's just that nobody has sued anybody yet, as the industry silently scrambles to look for alternatives. There is the law, and then there is enforcement of the law, and the latter has not fully happened yet.
• mhitza 5y ago
  > Or would that still violate GDPR as Google as an American company can still be coerced to give access to data stored on their servers outside the US? Yes, because of CLOUD Act. If GA would create a deployable agent that proceses user data on your server before sending it in aggregate/anonymously to central GA, that would make it usable
• d1sxeyes 5y ago
  From the Schrems II judgment: > Where the controller or a processor established in the European Union is not able to take adequate additional measures to guarantee such protection, the controller or processor or, failing that, the competent supervisory authority, are required to suspend or end the transfer of personal data to the third country concerned. It would seem as though any EU company that can be compelled to transfer data to the US would be found not to be able to take adequate measures to guarantee the protection of the data. I'm not familiar enough with the law in the US to understand whether the US authorities can compel an EU subsidiary of a US company to transfer data out of the EU, but if so...
  • Kbelicius 5y ago
    > I'm not familiar enough with the law in the US to understand whether the US authorities can compel an EU subsidiary of a US company to transfer data out of the EU, but if so... They can. If I remember correctly Microsoft refused FBI request for some data that was stored in Ireland so the Cloud Act was created.
    • realityking 5y ago
      It’s slightly more nuanced. In the case the FBI compelled Microsoft’s US operations, with employees based in the US to access data stored on a server in Ireland and to hand them over. GP is wondering if no US employees had access to the data directly if US law would have Microsoft US order Microsoft Ireland (which is a wholly owned subsidiary) to transfer the data to the US. It’s an interesting question. My non-lawyer take, even if they can force Microsoft US to make the request ultimately Microsoft Ireland is an Irish company operating under Irish law. If the data transfer to Microsoft US is illegal, they mustn’t do it. A situation where this already happens is technology transfers. If information is export controlled (mostly military related), a foreign non-EU/non-NATO owner of a German company can ask and demand as much as they want, non of their employees will ever see that information.
  • j16sdiz 5y ago
    guess this meant EU company can't do business with Chinese either.