The Swedish Data Protection Authority has fined two companies $1.1 million for using Google Analytics. It has also notified two other companies of similar practices.
See also: French privacy regulator: Google Analytics violates GDPR
The agency announced that companies' use of Google Analytics to generate web statistics violated the European Union's General Data Protection Regulation (GDPR), according to a ruling published yesterday.
Specifically, the companies were violating Article 46(1) of the GDPR, which prohibits the transfer of personal data to countries or international organizations that do not provide adequate safeguards for the security and legal protection of the data.
According to the “Schrems II” ruling issued in July 2020 by the Court of Justice of the European Union, the United States is considered a dangerous location for storing European users’ data. It was decided that any transfer of data to the US through the previous “Privacy Shield” mechanism was unlawful.
This violation is related to the same issue for which the Irish Data Protection Commission (DPC) fined Meta $1.3 billion for transferring user data located in the EU to servers located in the US.
The digital rights organization None of Your Business sued IMY. IMY subsequently conducted an audit to determine the type of data Google Analytics collects in the United States. It concluded that this data is personal information.
The audits concerned a version of the Google Analytics tool from August 14, 2020.
“IMY considers data transferred to the US through Google’s statistical tool to be personal data because it can be linked to other unique data transferred,” it says.
See also: Google: It may use public data to train its AI
The four companies that have been investigated are:
Tele2 SA (tele2.se) – Administrative fine of 12,000,000 SEK
CDON AB (cdon.fi) – Call for GDPR compliance and administrative fine of 300,000 SEK
Coop SA (coop.se) – Call for GDPR compliance
Dagens Industri (di.se) – Call for GDPR compliance
Tele2 SA – a telecommunications and internet service provider in Sweden, recently decided to stop using Google Analytics on its own initiative. The other three organizations are ordered to stop using Google Analytics and implement adequate data protection measures no later than one month after the IMY’s decision, which was announced on June 30, 2023.
The use of Google Analytics has previously been found to be non-compliant with the GDPR by data protection authorities in Austria, France and Italy. However, the IMY's decision to impose financial penalties on violators is the first such decision.
See also: Google: Violates the video ad standards it promised
These decisions also serve as guidance for other companies using Google Analytics, who may decide to adjust their strategy to comply with EU rules and regulations.
