Google Analytics doesn’t sufficiently protect European Union citizens’ data from potentially illegal US surveillance and could be banned altogether.
That’s the verdict of the French data watchdog, which said that moving vast troves of information across the Atlantic is currently unsafe. Thursday’s decision by the Commission nationale de l’informatique et des libertes is the latest parry in an increasingly tetchy back-and-forth between Big Tech and the bloc’s data privacy regulators.
A landmark European Union court ruling in 2020 raised the bar for the region’s watchdogs after judges expressed doubts about American surveillance laws and the safeguards in place to protect people’s data against unwarranted access from spies.
Transatlantic data transfers “are currently not sufficiently regulated,” CNIL said. Despite “additional measures” adopted by Google to make its Analytics tool safer, “these are not sufficient to exclude the accessibility of this data for US intelligence services.”
Google spokespeople didn’t immediately respond to an e-mail seeking comment.
The 2020 decision also struck down the Privacy Shield, a tool thousands of companies relied on to safely transfer data to the US, forcing EU-US negotiators back to the table to hammer out a new pact.
The French comments follow Meta Platforms’ renewed warning that the current regulatory situation in Europe could lead it to pulling Facebook and Instagram out of the region.
The controversy over data transfers stretches back to 2013, when former contractor Edward Snowden exposed the extent of spying by the US National Security Agency.
Risk of interception
CNIL said its probe followed complaints by privacy group Noyb against transatlantic transfers of data collected through Google Analytics.
The decision “shows that the regulator considers that the risk of interception is enough in the case of Google Analytics”, a spokesman for Noyb said. “That means that other US-based services where even more data are processed, will likely be subject to the same ruling.”
Facebook last year lost an Irish court fight over an initial order from its main EU privacy watchdog threatening a ban for its data transfers across the Atlantic. — Stephanie Bodoni, (c) 2022 Bloomberg LP