The Danish Data Protection Agency: Google Analytics may no longer be used legally
If necessary, this must be thoroughly analysed and documented. In practice, however, this will mean that Google Analytics can no longer be used in most cases.
Both the Austrian, French and Italian data supervisory authorities have previously made similar decisions regarding Google Analytics, and the decisions express a common European position among the supervisory authorities.
The decision is justified, among other things, in that the GDPR prevents the transfer of personal data to countries that do not ensure processing security equivalent to the GDPR rules.
Google Analytics may be used by implementing supplementary measures
If you as a company want to continue to use Google Analytics, it is a requirement that the company prepares a plan going forward for how it can be ensured that the personal data after being transferred to a third country continues to be protected, e.g., against transfer to the US intelligence services (so-called supplementary measures).
In connection with its decision, the French supervisory authority has drawn up a guide on what companies can do to secure personal data when transferred to Google in the US, e.g., by making use of pseudonymisation. You can read the instructions here.
If it is not possible to implement supplementary measures, it is no longer possible to legally use Google Analytics, and companies must therefore find alternative options for collecting data, analysis, and statistics about their users' use of websites, etc.
Lund Elmer Sandager's comments
There is now a big task ahead of several Danish companies that use Google Analytics, which must now assess whether they can continue to use the analysis tool. If the individual company assesses that it will continue to use Google Analytics, supplementary measures must be initiated.
You can read the Danish Data Protection Authority's decision here.
If you have questions about the Danish Data Protection Agency's conclusion, or if you have other questions regarding the GDPR rules, please do not hesitate to contact our GDPR and Data Protection Specialist Partner, Attorney Torsten Hylleberg.
