4 ms·

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Priva

For who needs a summary of what is happening in the EU [1] 1. Since 2020, it's illegal to send personal data to the US because of the invalidation of the Privacy Shield [2] 2. Google said it was okay in the EU to use anonymized IP addresses 3. The Austrian Data Protection Authority (DSB) [3] ruled differently and waived most of the arguments raised by Google. The DSB ruled that even anonymized IP addresses are personal data. 4. The Data Protection Authority of The Netherlands followed by implying that the use of Google Analytics might be banned in the future [4] 5. In February 2022 The Data Protection Authority of France (CNIL) followed [5] 6. In June 2022 the Data Protection Authority of Italy (Garante) followed [6] 7. Now, September 2022, Denmark – after already banning Google Workspace for municipalities [7] – considers Google Analytics unlawful as well [8] This is a sound decision, but not a new one. It's a confirmation of what has been ruled in July 2020, but now it seems to have more impact. PS: I'm the founder of Simple Analytics [9] - the privacy-first analytics tool that, unlike other privacy tools, does not use any identifiers. [1] https://blog.simpleanalytics.com/will-google-analytics-be-banned-in-the-eu https://blog.simpleanalytics.com/will-google-analytics-be-ba... [2] https://iapp.org/news/a/the-schrems-ii-decision-eu-us-data-transfers-in-question/ https://iapp.org/news/a/the-schrems-ii-decision-eu-us-data-t... [3] https://www.data-protection-authority.gv.at/ https://www.data-protection-authority.gv.at/ [4] https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/internet-telefoon-tv-en-post/cookies#hoe-kan-ik-bij-google-analytics-de-privacy-van-mijn-websitebezoekers-beschermen-4898 https://autoriteitpersoonsgegevens.nl/nl/onderwerpen/interne... (in Dutch) [5] https://www.cnil.fr/en/use-google-analytics-and-data-transfers-united-states-cnil-orders-website-manageroperator-comply https://www.cnil.fr/en/use-google-analytics-and-data-transfe... [6] https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9782874#english https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d... [7] https://www.simpleanalytics.com/blog/denmark-bans-google-workspace-for-municipalities https://www.simpleanalytics.com/blog/denmark-bans-google-wor... (includes translated version) [8] https://www.datatilsynet.dk/english/google-analytics/use-of-google-analytics-for-web-analytics https://www.datatilsynet.dk/english/google-analytics/use-of-... (this thread) [9] https://www.simpleanalytics.com/ https://www.simpleanalytics.com/

dataking 4y ago
Thanks for you summary! I, for one, needed it. Can you comment on why the BSB found that anonymized IP addresses are personal data (3rd point). Is it because the anonymization is too weak? Edit: seems GA only masks the last octet of an IP4 address.
- AdriaanvRossum 4y ago
  See the PDF from Google as a response to Austrian DPA [1]. See heading "Technical and Organizational Measures" on page 23 and "Optional Technical Measure" on page 26. More you can find in the NOYB blog post [2]. NOYB is the organization who imitated the complaints towards Google (Analytics). > While Google has made submissions claiming that has implemented "Technical and Organizational Measures" ("TOMs") [1], which included ideas like having fences around data centers, reviewing requests or having baseline encryption, the DSB has rejected these measures as absolutely useless when it comes to US surveillance (page 38 and 39 of the decision): > "With regard to the contractual and organizational measures outlined, it is not apparent, to what extent [the measure] are effective in the sense of the above considerations." > "Insofar as the technical measures are concerned, it is also not recognizable (...) to what extent [the measure] would actually prevent or limit access by U.S. intelligence agencies considering U.S. law." > Max Schrems: "This is a very detailed and sound decision. The bottom line is: Companies can't use US cloud services in Europe anymore. It has now been 1.5 years since the Court of Justice confirmed this a second time, so it is more than time that the law is also enforced." [1] https://noyb.eu/sites/default/files/2021-05/2021-04-09_Response_to_Austrian_DPA_-_NOYB_Complaints_b.pdf https://noyb.eu/sites/default/files/2021-05/2021-04-09_Respo... [2] https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-...
  - gpderetta 4y ago
    I don't know, it might work; how good are US law enforcement agents at climbing fences?
lucb1e 4y ago
Wow, nice overview! This is worthy of a submission of its own (perhaps in prose with the links inlined), this shouldn't be at the bottom of some other thread.

dataking 4y ago

Thanks for you summary! I, for one, needed it. Can you comment on why the BSB found that anonymized IP addresses are personal data (3rd point). Is it because the anonymization is too weak? Edit: seems GA only masks the last octet of an IP4 address.

AdriaanvRossum 4y ago
See the PDF from Google as a response to Austrian DPA [1]. See heading "Technical and Organizational Measures" on page 23 and "Optional Technical Measure" on page 26. More you can find in the NOYB blog post [2]. NOYB is the organization who imitated the complaints towards Google (Analytics). > While Google has made submissions claiming that has implemented "Technical and Organizational Measures" ("TOMs") [1], which included ideas like having fences around data centers, reviewing requests or having baseline encryption, the DSB has rejected these measures as absolutely useless when it comes to US surveillance (page 38 and 39 of the decision): > "With regard to the contractual and organizational measures outlined, it is not apparent, to what extent [the measure] are effective in the sense of the above considerations." > "Insofar as the technical measures are concerned, it is also not recognizable (...) to what extent [the measure] would actually prevent or limit access by U.S. intelligence agencies considering U.S. law." > Max Schrems: "This is a very detailed and sound decision. The bottom line is: Companies can't use US cloud services in Europe anymore. It has now been 1.5 years since the Court of Justice confirmed this a second time, so it is more than time that the law is also enforced." [1] https://noyb.eu/sites/default/files/2021-05/2021-04-09_Response_to_Austrian_DPA_-_NOYB_Complaints_b.pdf https://noyb.eu/sites/default/files/2021-05/2021-04-09_Respo... [2] https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-...
- gpderetta 4y ago
  I don't know, it might work; how good are US law enforcement agents at climbing fences?

lucb1e 4y ago

Wow, nice overview! This is worthy of a submission of its own (perhaps in prose with the links inlined), this shouldn't be at the bottom of some other thread.