Table of contents of the article:
ROME: June 23, 2022:
The website that uses the Google Analytics (GA) service, without the guarantees provided by the EU Regulation, violates the data protection legislation because it transfers user data to the United States, a country without an adequate level of protection.
The Italian Data Protection Authority (Garante per la Privacy) made this finding following a complex investigation launched based on a series of complaints and in coordination with other European data protection authorities. The Authority's investigation revealed that website operators using GA collect, through cookies, information on user interactions with those sites, the individual pages visited, and the services offered. Among the many data collected are the user's device's IP address and information relating to the browser, operating system, screen resolution, language selection, as well as the date and time of the website visit. This information was found to be transferred to the United States. In declaring the processing unlawful, it was reiterated that the IP address constitutes personal data and, even if truncated, would not become anonymous, given Google's ability to enrich it with other data in its possession.
Following these investigations, the Italian Data Protection Authority (Garante) adopted the first in a series of measures, warning Caffeina Media Srl, a website operator, to comply with the European Regulation within ninety days. This timeframe was deemed adequate to allow the operator to adopt appropriate measures for the transfer, under penalty of suspension of data flows sent via GA to the United States.
The Guarantor highlighted, in particular, the possibility for US government authorities and intelligence agencies to access personal data transferred without due guarantees, noting in this regard that, in the light of the information provided by the EDPB (Recommendation no. 1/2020 of 18 June 2021), the measures that integrate the transfer tools adopted by Google do not currently guarantee an adequate level of protection of users' personal data.
The Authority takes this opportunity to draw the attention of all Italian website operators, both public and private, to the unlawfulness of data transfers to the United States through GA, also in light of the numerous reports and questions the Office is receiving. It also invites all data controllers to verify that the methods used for using cookies and other tracking tools on their websites, particularly Google Analytics and other similar services, comply with data protection legislation.
Upon expiry of the 90-day term assigned to the company to which the provision is addressed, the Guarantor will proceed, also on the basis of specific inspection activities, to verify compliance with the EU Regulation of data transfers carried out by the owners.
