A French company has been ordered to stop using Google Analytics after authorities say the data could be accessed by U.S. intelligence services, posing a GDPR “risk”.
France’s data protection agency, which has previously expressed concerns that Apple ads could violate GDPR laws, has now concluded that access to Google Analytics certainly does. It invoked the European Union’s General Data Protection Regulation to order at least one French company to stop using the service from Google.
According to Le Monde, the National Commission for Informatics and Liberty (CNIL) has issued an official statement regarding the unnamed company. “The site administrator has one month to adjust to comply with the directive,” the statement said.
CNIL states that data on internet users (collected by Google Analytics) was transferred to the United States in violation of the GDPR…,” the statement continued. “It, therefore, requires website managers to bring this processing into compliance with the GDPR and, if necessary, to stop using Google Analytics functions (under current conditions), or to use tools that do not result in data being transferred outside the EU.
Europe enacted GDPR in 2018, but Le Monde said the new move against an unspecified number of companies was based on a July 2020 case, dubbed “Schrems II,” a decision by the Court of Justice of the European Union to any data transfer outside the EU.
The CNIL said the ruling “underscores the risk that U.S. intelligence services will gain access to personal data transferred to the United States,” or at least possibly “if the transfer is not properly regulated.”
Google did not comment on the CNIL’s decision. However, its support page acknowledges that Google Analytics is not GDPR compliant by default. However, the same page offers a range of options to help users comply with the regulation.
These moves do not now appear to satisfy the CNIL: “While Google has taken additional steps to regulate data transfers under the Google Analytics feature, these are not sufficient to rule out [US intelligence access].”