25 ms·

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Priva

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are personal data. 4. The Data Protection Authority of The Netherlands followed by implying that the use of Google Analytics might be banned in the future [4] 5. Now, the Data Protection Authority of France (CNIL) followed This is a sound decision, but not a new one. It's a confirmation of what has been ruled in July 2020, but now it seems to have more impact. PS: I'm the founder of Simple Analytics [5] - the privacy-first analytics tool that, unlike other privacy tools, does not use any identifiers. [1] https://blog.simpleanalytics.com/will-google-analytics-be-banned-in-the-eu https://blog.simpleanalytics.com/will-google-analytics-be-ba... [2] https://iapp.org/news/a/the-schrems-ii-decision-eu-us-data-transfers-in-question/ https://iapp.org/news/a/the-schrems-ii-decision-eu-us-data-t... [3] https://www.data-protection-authority.gv.at/ https://www.data-protection-authority.gv.at/ [4] https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/internet-telefoon-tv-en-post/cookies#hoe-kan-ik-bij-google-analytics-de-privacy-van-mijn-websitebezoekers-beschermen-4898 https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/interne... (in Dutch) [5] https://simpleanalytics.com/ https://simpleanalytics.com/ EDIT: changed "PII (personally identifiable)" to "Personal Data"

phkahler 5y ago
>> Since 2020, it's illegal to send PII (personally identifiable) data to the US because of the removal of the Privacy Shield Framework [ This sounds like some great politicized naming. Removal of the "Privacy Shield" seems to be increasing privacy in this case.
- the-dude 5y ago
  Par for the course. Peace mission.
- AdriaanvRossum 5y ago
  You are right, rewrote it as "invalidated"
- hedora 5y ago
  The privacy shield is like a radiation shield or a wind shield.
  - phkahler 5y ago
    So it deflects privacy! Who is it protecting from privacy?
cnorthwood 5y ago
Point 1 isn't true. You've been able to send personal data (PII being the specific US legal term) to the US no problem - as long as you had "standard contractual clauses" (SCCs) as part of your contract with them that the company meets GDPR requirements. This is the same agreement to send data to any country outside the EU where there isn't a pre-existing agreement. I believe this ruling is saying that it's not possible for a US company to comply with the SCCs because US law doesn't allow them to do so.
- lmkg 5y ago
  The original ruling was nuanced, and this ruling is clarifying some gray area inside of it. The ruling on Schrems II (the court case that struck down Privacy Shield) did not state that SCCs on their own would be sufficient. It said that SCCs + "additional safeguards" would be allowable. There have been several rulings already that SCCs on their own are not sufficient. The "additional safeguards" must include a risk analysis of US access to EU residents' data. Every court case I've seen from Schrems II onward identifies the US CLOUD Act as the privacy risk to address. CNIL is basically ruling that you cannot transfer data to a US company subject to the CLOUD Act, and an SCC cannot deal with that. This still leaves open the possibility of using US services that are not subject to the CLOUD Act. This is consistent with all rulings to date.
  - fprct 5y ago
    Wait, wouldn't that imply that EU startups can't host their infra on GCP, AWS or Azure? I'm not even talking about analytics - just about simple user email required to login would be problematic now.
    - judge2020 5y ago
      Pretty much, it really sounds like Schrems II + this ruling mean that US corporations can't be involved with EU at all besides via licensing software to a completely independent EU corporation (which isn't a given either, though, since the US company could threaten withholding software updates/revoking the software license to pressure the EU corporation to hand over EU citizen data to US Law Enforcement).
kiallmacinnes 5y ago
> 1. Since 2020, it's illegal to send PII (personally identifiable) data to the US because of the removal of the Privacy Shield Framework [2] Minor nit - "PII" really isn't the right term to use, because it suggests the info itself must be personally identifiable to an individual. The GDPR covers much more than this, and uses the term "Personal Data".
- AdriaanvRossum 5y ago
  Thanks, updated the comment.
judge2020 5y ago
If I’m not mistaken, isn’t Google now using Google Ireland Limited as the corporation that houses EU-incoming data, and thus they keep the EU data in datacenters owned by that shell company (and physically within the EU)?
- axiosgunnar 5y ago
  Doesn't matter one single bit, they are still the 100% subsidiary of Alphabet which is legally bound to provide data at the request of US gov agencies.
  - judge2020 5y ago
    Is that really the only reason behind GA being 'banned'? If google broke off Ireland ltd into its own company and that company simply 'licensed' Google products for $1, would they be in the clear?
    - lmkg 5y ago
      What matters is the US CLOUD Act, because that's the thing that lets US Intelligence have access to data stored in EU servers. If legal arrangement is covered by the CLOUD Act, it's a GDPR violation.
    - altairprime 5y ago
      Unlikely. The EU courts would reasonably be expected to decide that, as Google Ireland is merely a sham corp for the purpose of operating a codebase that is wholly deferred to the same US control (just as before the sham corp), that this is equivalent to the prior arrangement and still illegal.
  - stdgy 5y ago
    Could they house their data in a separate company that was founded in Ireland and is not an Alphabet subsidiary to get around this?
    - 5y ago
eps 5y ago
> the privacy-first analytics tool Don't be coy. Call it what it is - an analytics service. And as such it falls largerly in the same bucket as GA, because if someone's using Simple Analytics, my surfing data - against my wishes - is being shared with some random third party. Whether it's less, more or comparably evil as GA is secondary.
- jraph 5y ago
  it's not the privacy-first analytics tool neither. It's a tool. Matomo is the privacy-friendly analytics tool that comes to my mind anyway. (I have nothing to do with Matomo other than I used PhpMyVisites a few years ago. It had time to change its name twice since then)
  - bsedlm 5y ago
    there's a difference between a service and a tool. do not blur out this distinction. thanks.
    - jraph 5y ago
      That was not my point and I didn't want to make my message more complicated. This point has already clearly been made by my parent comment. I agree with you though.
- AdriaanvRossum 5y ago
  I understand your concern. It's also an analytics service. But I believe we are very different [1]. We deliberately collect very little data [2]. There is a big difference between "a person's surfing data" or "surfing data of all visitors combined". That's what we promise with Simple Analytics. [1] https://blog.simpleanalytics.com/why-simple-analytics-is-a-great-alternative-to-google-analytics#1-differences-in-core-values-privacy-first-vs-profit-first https://blog.simpleanalytics.com/why-simple-analytics-is-a-g... [2] https://docs.simpleanalytics.com/what-we-collect https://docs.simpleanalytics.com/what-we-collect
  - 5y ago
lmkg 5y ago
There's a HUGE important aspect that you're missing: The IP Address is NOT the only thing that makes this data into personal data. Google Analytics generates a visitor ID by rolling a random number and storing it in a first-party cookie. This is how GA tells that two visits a week apart came from the same user. This value has been ruled to constitute Personal Data. This is a very big deal, and only a little bit surprising.
- throwhauser 5y ago
  > The IP Address is NOT the only thing that makes this data into personal data. Can you cite a reference for that? I fully believe that Google is using cookies for this, but that doesn't mean that the legal authority here isn't making the judgment on IP address alone. I believe a recent GDPR decision against Google Fonts was based on IP address alone. [0] [0] https://news.ycombinator.com/item?id=30135264 https://news.ycombinator.com/item?id=30135264
  - lmkg 5y ago
    The linked article. Relevant quote: > In this context, a unique identifier is assigned to each visitor. This identifier (which constitutes personal data) and the associated data are transferred by Google to the United States. This is an accurate description of GA's pseudonymous identifier. It is not accurate as a description of an IP address. And if CNIL meant the IP Address, they would have said so, as they did in other rulings.
  - sqrt2 5y ago
    The Google Fonts case was decided based on the transmission of the full IP address in a jurisdiction (Germany) where there are ways to identify a user by means of that address. CNIL's press release follows a decision by the Austrian data protection authority where the Google Analytics cookies were at issue. If you can read German, you can look at the Austrian decision directly, the complainant has uploaded it at [1] and the relevant section is D.2 b) starting at page 27. [1] https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Google%20Analytics_DE_bk_0.pdf https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Goog...
deleted 5y ago
[deleted]
weissed 5y ago
> The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are personal data. Why are anonymised IP addresses still considered "Personal Data"? Is it because Google is doing the anonymisation?
- newaccount74 5y ago
  I guess it depends what "anonymised IP address" means. If it's still possible to correlate data from visitors across different websites, they might as well log IP addresses directly.
  - judge2020 5y ago
    The court disagreed on the basis that US federal law enforcement could force Google to stop anonymizing IP addresses at any moment, not that their IP anonymization[0] is inadequate. 0: https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en
- AdriaanvRossum 5y ago
  I think it's personal data because you can track a visitor across multiple visits. Based on that identifier you can connect all the other data points from a visitor. I think that's not privacy-friendly at all.
- things 5y ago
  I believe the issue isn't specifically with anonymised IP addresses in GA. The problem is that the Google Analytics code is loaded from a third party server and, to do that, this server gets your IP address even if the data sent by the GA code itself contains an anonymised one.

phkahler 5y ago

>> Since 2020, it's illegal to send PII (personally identifiable) data to the US because of the removal of the Privacy Shield Framework [ This sounds like some great politicized naming. Removal of the "Privacy Shield" seems to be increasing privacy in this case.

the-dude 5y ago
Par for the course. Peace mission.
AdriaanvRossum 5y ago
You are right, rewrote it as "invalidated"
hedora 5y ago
The privacy shield is like a radiation shield or a wind shield.
- phkahler 5y ago
  So it deflects privacy! Who is it protecting from privacy?

cnorthwood 5y ago

Point 1 isn't true. You've been able to send personal data (PII being the specific US legal term) to the US no problem - as long as you had "standard contractual clauses" (SCCs) as part of your contract with them that the company meets GDPR requirements. This is the same agreement to send data to any country outside the EU where there isn't a pre-existing agreement. I believe this ruling is saying that it's not possible for a US company to comply with the SCCs because US law doesn't allow them to do so.

lmkg 5y ago
The original ruling was nuanced, and this ruling is clarifying some gray area inside of it. The ruling on Schrems II (the court case that struck down Privacy Shield) did not state that SCCs on their own would be sufficient. It said that SCCs + "additional safeguards" would be allowable. There have been several rulings already that SCCs on their own are not sufficient. The "additional safeguards" must include a risk analysis of US access to EU residents' data. Every court case I've seen from Schrems II onward identifies the US CLOUD Act as the privacy risk to address. CNIL is basically ruling that you cannot transfer data to a US company subject to the CLOUD Act, and an SCC cannot deal with that. This still leaves open the possibility of using US services that are not subject to the CLOUD Act. This is consistent with all rulings to date.
- fprct 5y ago
  Wait, wouldn't that imply that EU startups can't host their infra on GCP, AWS or Azure? I'm not even talking about analytics - just about simple user email required to login would be problematic now.
  - judge2020 5y ago
    Pretty much, it really sounds like Schrems II + this ruling mean that US corporations can't be involved with EU at all besides via licensing software to a completely independent EU corporation (which isn't a given either, though, since the US company could threaten withholding software updates/revoking the software license to pressure the EU corporation to hand over EU citizen data to US Law Enforcement).

kiallmacinnes 5y ago

> 1. Since 2020, it's illegal to send PII (personally identifiable) data to the US because of the removal of the Privacy Shield Framework [2] Minor nit - "PII" really isn't the right term to use, because it suggests the info itself must be personally identifiable to an individual. The GDPR covers much more than this, and uses the term "Personal Data".

AdriaanvRossum 5y ago
Thanks, updated the comment.

judge2020 5y ago

If I’m not mistaken, isn’t Google now using Google Ireland Limited as the corporation that houses EU-incoming data, and thus they keep the EU data in datacenters owned by that shell company (and physically within the EU)?

axiosgunnar 5y ago
Doesn't matter one single bit, they are still the 100% subsidiary of Alphabet which is legally bound to provide data at the request of US gov agencies.
- judge2020 5y ago
  Is that really the only reason behind GA being 'banned'? If google broke off Ireland ltd into its own company and that company simply 'licensed' Google products for $1, would they be in the clear?
  - lmkg 5y ago
    What matters is the US CLOUD Act, because that's the thing that lets US Intelligence have access to data stored in EU servers. If legal arrangement is covered by the CLOUD Act, it's a GDPR violation.
  - altairprime 5y ago
    Unlikely. The EU courts would reasonably be expected to decide that, as Google Ireland is merely a sham corp for the purpose of operating a codebase that is wholly deferred to the same US control (just as before the sham corp), that this is equivalent to the prior arrangement and still illegal.
- stdgy 5y ago
  Could they house their data in a separate company that was founded in Ireland and is not an Alphabet subsidiary to get around this?
  - 5y ago

eps 5y ago

> the privacy-first analytics tool Don't be coy. Call it what it is - an analytics service. And as such it falls largerly in the same bucket as GA, because if someone's using Simple Analytics, my surfing data - against my wishes - is being shared with some random third party. Whether it's less, more or comparably evil as GA is secondary.

jraph 5y ago
it's not the privacy-first analytics tool neither. It's a tool. Matomo is the privacy-friendly analytics tool that comes to my mind anyway. (I have nothing to do with Matomo other than I used PhpMyVisites a few years ago. It had time to change its name twice since then)
- bsedlm 5y ago
  there's a difference between a service and a tool. do not blur out this distinction. thanks.
  - jraph 5y ago
    That was not my point and I didn't want to make my message more complicated. This point has already clearly been made by my parent comment. I agree with you though.
AdriaanvRossum 5y ago
I understand your concern. It's also an analytics service. But I believe we are very different [1]. We deliberately collect very little data [2]. There is a big difference between "a person's surfing data" or "surfing data of all visitors combined". That's what we promise with Simple Analytics. [1] https://blog.simpleanalytics.com/why-simple-analytics-is-a-great-alternative-to-google-analytics#1-differences-in-core-values-privacy-first-vs-profit-first https://blog.simpleanalytics.com/why-simple-analytics-is-a-g... [2] https://docs.simpleanalytics.com/what-we-collect https://docs.simpleanalytics.com/what-we-collect
- 5y ago

lmkg 5y ago

There's a HUGE important aspect that you're missing: The IP Address is NOT the only thing that makes this data into personal data. Google Analytics generates a visitor ID by rolling a random number and storing it in a first-party cookie. This is how GA tells that two visits a week apart came from the same user. This value has been ruled to constitute Personal Data. This is a very big deal, and only a little bit surprising.

throwhauser 5y ago
> The IP Address is NOT the only thing that makes this data into personal data. Can you cite a reference for that? I fully believe that Google is using cookies for this, but that doesn't mean that the legal authority here isn't making the judgment on IP address alone. I believe a recent GDPR decision against Google Fonts was based on IP address alone. [0] [0] https://news.ycombinator.com/item?id=30135264 https://news.ycombinator.com/item?id=30135264
- lmkg 5y ago
  The linked article. Relevant quote: > In this context, a unique identifier is assigned to each visitor. This identifier (which constitutes personal data) and the associated data are transferred by Google to the United States. This is an accurate description of GA's pseudonymous identifier. It is not accurate as a description of an IP address. And if CNIL meant the IP Address, they would have said so, as they did in other rulings.
- sqrt2 5y ago
  The Google Fonts case was decided based on the transmission of the full IP address in a jurisdiction (Germany) where there are ways to identify a user by means of that address. CNIL's press release follows a decision by the Austrian data protection authority where the Google Analytics cookies were at issue. If you can read German, you can look at the Austrian decision directly, the complainant has uploaded it at [1] and the relevant section is D.2 b) starting at page 27. [1] https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Google%20Analytics_DE_bk_0.pdf https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Goog...

deleted 5y ago

[deleted]

weissed 5y ago

> The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are personal data. Why are anonymised IP addresses still considered "Personal Data"? Is it because Google is doing the anonymisation?

newaccount74 5y ago
I guess it depends what "anonymised IP address" means. If it's still possible to correlate data from visitors across different websites, they might as well log IP addresses directly.
- judge2020 5y ago
  The court disagreed on the basis that US federal law enforcement could force Google to stop anonymizing IP addresses at any moment, not that their IP anonymization[0] is inadequate. 0: https://support.google.com/analytics/answer/2763052?hl=en https://support.google.com/analytics/answer/2763052?hl=en
AdriaanvRossum 5y ago
I think it's personal data because you can track a visitor across multiple visits. Based on that identifier you can connect all the other data points from a visitor. I think that's not privacy-friendly at all.
things 5y ago
I believe the issue isn't specifically with anonymised IP addresses in GA. The problem is that the Google Analytics code is loaded from a third party server and, to do that, this server gets your IP address even if the data sent by the GA code itself contains an anonymised one.