Take-Aways (AI)
  • The DSK clas­si­fi­es Goog­le as a joint con­trol­ler when using Goog­le Ana­ly­tics; this requi­res an Art. 26 GDPR agree­ment bet­ween the par­ties involved.
  • As a rule, Goog­le Ana­ly­tics may only be used with the effec­ti­ve, trans­pa­rent and vol­un­t­a­ry con­sent of the user in accordance with Art. 6 para. 1 lit. a and Art. 7 GDPR.

The Ger­man Con­fe­rence of Data Pro­tec­tion Super­vi­so­ry Aut­ho­ri­ties (DSK) has set a date of May 12, 2020 for the Notes on the use of Goog­le Ana­ly­tics by pri­va­te enti­ties published:

Against the back­drop of the new legal frame­work with the appli­ca­ti­on of the GDPR, the data pro­tec­tion super­vi­so­ry aut­ho­ri­ties have the Use of Goog­le Ana­ly­tics re-eva­lua­ted. Older views of data pro­tec­tion super­vi­so­ry aut­ho­ri­ties, which were com­mu­ni­ca­ted taking into account the legal situa­ti­on pri­or to 25.05.2018, are thus con­side­red obso­le­te. [Fn: This applies in par­ti­cu­lar to the publi­ca­ti­on of the Ham­burg Com­mis­sio­ner for Data Pro­tec­tion and Free­dom of Infor­ma­ti­on, “Notes for web­site ope­ra­tors based in Ham­burg who use Goog­le Analytics.”]

The notes app­ly to the use of Goog­le Ana­ly­tics in the Stan­dard con­fi­gu­ra­ti­on (wit­hout, for exam­p­le, Ana­ly­tics 360).

Comm­ents

The DSK brief­ly sta­tes that

  • Goog­le in the use of Goog­le Ana­ly­tics with the web­site ope­ra­tor as a who­le joint­ly respon­si­ble is and
  • Goog­le Ana­ly­tics only with Con­sent may be used.

As far as the requi­re­ment of con­sent is con­cer­ned, the posi­ti­on of the FSC is in line with the views alre­a­dy expres­sed ear­lier by aut­ho­ri­ties (e.g. the LfDI Rhi­ne­land-Pala­ti­na­te) and as far as can be seen of the Admi­ni­stra­ti­ve Court Mainz (cf. also here).

What is new, howe­ver, is the assess­ment that Goog­le is a joint­ly respon­si­ble par­ty. The infor­ma­ti­on pro­vi­ded by Goog­le Order pro­ce­s­sing agree­ment does not chan­ge this. This means that the use of Goog­le Ana­ly­tics requi­res not only con­sent (which, inci­den­tal­ly, con­firms once again that the trans­fer of data bet­ween joint con­trol­lers is not pri­vi­le­ged, but requi­res a legal basis), but also an agree­ment bet­ween joint con­trol­lers within the mea­ning of Artic­le 26 GDPR. So far, Goog­le has not sub­mit­ted a cor­re­spon­ding agreement.

For Com­pa­ny in Switz­er­land the GDPR may be appli­ca­ble if the user beha­vi­or of per­sons resi­ding in the EEA (inclu­ding Liech­ten­stein) is coll­ec­ted. In this case, the requi­re­ments of the GDPR would have to be imple­men­ted (alt­hough the­se are not legal­ly bin­ding). One pos­si­bi­li­ty may be to exclude access from abroad or not to record it. Wit­hout such mea­su­res, the use of Goog­le Ana­ly­tics requi­res an assess­ment of the legal risk.

The Swiss DPA regu­la­tes the use of Goog­le Ana­ly­tics through the gene­ral Pro­ce­s­sing prin­ci­ples and by the Swiss coo­kie pro­vi­si­on, Art. 45c TCA – pro­vi­ded that it can also be assu­med for Switz­er­land that per­so­nal data is pro­ce­s­sed by Goog­le Ana­ly­tics, which is by no means a mat­ter of cour­se. This legal situa­ti­on will hard­ly chan­ge with the revi­si­on of the DPA, apart from the infor­ma­ti­on requi­re­ments accor­ding to Art. 17 E‑DSG. Con­sent to the use of Goog­le Ana­ly­tics is thus not neces­sa­ry. A trans­fer of per­so­na­li­ty pro­files or – depen­ding on the offer of a web­site – per­so­nal data requi­ring spe­cial pro­tec­tion – to Goog­le should not be pre­sent, sin­ce Goog­le coll­ects this data its­elf or is an order pro­ces­sor under Swiss law. Also from this point of view, the­r­e­fo­re No con­sent requi­red be

Also a Agree­ment bet­ween joint­ly respon­si­ble is not neces­sa­ry in its­elf. The FADP and the e‑DSA do not gene­ral­ly requi­re such an agree­ment, even though it may make sen­se in the case of data pro­ce­s­sing based on the divi­si­on of labor. Sin­ce Goog­le is sub­ject to the GDPR, Goog­le would have to requi­re the con­clu­si­on of such an agree­ment with Swiss web­site ope­ra­tors: Admit­ted­ly, the lat­ter should not be sub­ject to the GDPR alre­a­dy becau­se they pro­cess data joint­ly with a con­trol­ler in the EEA. But the agree­ment bet­ween joint con­trol­lers is inten­ded to ensu­re the pro­per dis­tri­bu­ti­on of com­pli­ance obli­ga­ti­ons, and if the Swiss con­trol­ler assu­mes such obli­ga­ti­ons wit­hout com­mit­ting to the GDPR stan­dard, its EEA coun­ter­part would run the risk of a regu­la­to­ry gap.

Appli­ca­bi­li­ty of the GDPR

First of all, DSK sta­tes the fol­lo­wing or takes the fol­lo­wing view:

When Goog­le Ana­ly­tics is used always pro­ce­s­ses per­so­nal data of the users.

Here, the FDPIC express­ly dis­agrees with the view of Goog­le its­elf, accor­ding to which usa­ge data do not con­sti­tu­te per­so­nal data. Howe­ver, the FDPIC does not fur­ther sub­stan­tia­te its opi­ni­on on this point – which is not self-evident.

Role allo­ca­ti­on: Goog­le as joint­ly respon­si­ble party

Goog­le in the use of Goog­le Ana­ly­tics, accor­ding to DSK not acting as a pro­ces­sor.

DSK on this:

When using Goog­le Ana­ly­tics, the web­site ope­ra­tor does not sole­ly deter­mi­ne the Pur­po­ses and means of data pro­ce­s­sing. The­se are rather part­ly given exclu­si­ve­ly by Goog­leso that Goog­le its­elf is respon­si­ble in this respect, and con­trac­tual­ly accept­ed by the site ope­ra­tor. The pro­ce­s­sing when using Goog­le Ana­ly­tics repres­ents a sin­gle life cir­cum­stance in which the various aspects of the pro­ce­s­sing only make sen­se as a who­le. This has the con­se­quence that the par­ties within a pro­ce­s­sing acti­vi­ty do not chan­ge their role as pro­ces­sor and/or con­trol­ler can.

Here, too, the DPA dis­agrees with Goog­le, accor­ding to which Goog­le acts as pro­ces­sor for cer­tain pro­ce­s­sing ope­ra­ti­ons and as con­trol­ler for others (on the lat­ter, cf. the Shared Data Under Mea­su­re­ment Con­trol­ler-Con­trol­ler Data Pro­tec­tion Terms of Goog­le). Rather, Goog­le and the web­site ope­ra­tor were joint­ly respon­si­ble in the sen­se of Art. 26 DSGVO.

Legal basis: Consent

Sin­ce Goog­le Ana­ly­tics is not neces­sa­ry for the con­tract, Artic­le 6 (1) (b) of the GDPR is not a legal basis. Artic­le 6 (1) (f) DSGVO (legi­ti­ma­te inte­rest) also does not app­ly “as a rule”:

In view of the spe­ci­fic data pro­ce­s­sing steps invol­ved in the use of Goog­le Ana­ly­tics, the inte­rests, fun­da­men­tal rights and free­doms of users regu­lar­ly out­weigh the inte­rests of web­site ope­ra­tors. In par­ti­cu­lar the user does not rea­son­ab­ly expect that his per­so­nal data will be pas­sed on to third par­ties and com­pre­hen­si­ve­ly eva­lua­ted with the aim of crea­ting per­so­nal adver­ti­sing and lin­king it with the per­so­nal data obtai­ned from other con­texts. This goes far bey­ond thatwhich is per­mis­si­ble within the scope of Art. 6 (1) f) DS-GVO. In this respect, the situa­ti­on dif­fers signi­fi­cant­ly from the case of a sta­tis­tics func­tion on one’s own web­site or by means of com­mis­sio­ned processing.

The­r­e­fo­re, as a rule, only con­sent remains:

As a result, a lawful use of Goog­le Ana­ly­tics is gene­ral­ly only pos­si­ble on the basis of an effec­ti­ve con­sent of the web­site visi­tors pur­su­ant to Art. 6 (1) a), Art. 7 DS-GVO.

Obtai­ning consent

Con­sent to the pro­ce­s­sing of per­so­nal data by Goog­le Ana­ly­tics is sub­ject to the usu­al requi­re­ments. In this regard, the DSK sta­tes, among other things, that

  • in the Decla­ra­ti­on of con­sent to be cle­ar­ly and unam­bi­guous­ly descri­bed must, that the pro­ce­s­sing is essen­ti­al­ly car­ri­ed out by Goog­le, that the data is not anony­mous, what data is pro­ce­s­sed and that Goog­le uses it for “any of its own pur­po­ses such as pro­fil­ing” as well as “links it to other data such as any Goo­g­le­Ac­counts”. Goog­le must be expli­ci­t­ly listed as a reci­pi­ent of the data;
  • Users Acti­ve only can con­sent (e.g. clicking a button);
  • no data may be coll­ec­ted or ele­ments rel­oa­ded from Goog­le web­sites pri­or to consent;
  • the con­sent only vol­un­t­a­ry is when the per­son con­cer­ned has opti­ons and a free choice. They must also be able to refu­se con­sent wit­hout suf­fe­ring any dis­ad­van­ta­ges as a result. The cou­pling with a ser­vice could lead to the con­sent not being voluntary.

In addi­ti­on, a Pos­si­bi­li­ty of objec­tion for exam­p­le by inclu­ding a cor­re­spon­ding but­ton. It is not suf­fi­ci­ent to sim­ply make refe­rence to the Goog­le Opt Out Add-On, inter alia, becau­se this revo­ca­ti­on is not as simp­le as giving consent.

Other requi­re­ments

Fur­ther, the pri­va­cy poli­cy must explain the pro­ce­s­sing by Goog­le Ana­ly­tics, and users “should” have the Shor­tening of the IP address by Goog­le Activate.