Websites that use the service without the guarantees provided by the Gdpr expose personal information in violation of the legislation. Adopted the "first of a series of measures", announces the authority, with the warning to Caffeina Media 23 Jun 2022 Patrizia Licata journalist
Websites that use the Google Analytics service without the guarantees provided by the GDPR violate data protection legislation because they transfer user data to the United States, a country without an adequate level of protection. This was stated by the Italian Privacy Guarantor at the conclusion of a complex investigation launched on the basis of a series of complaints and in coordination with other European privacy authorities, as can be read on the authority's website. The investigation of the Guarantor has shown that the managers of the websites that use Google Analytics collect, through cookies, information on the interactions of users with their sites, the individual pages visited and the services offered. Among the many data collected are the IP address of the user's device and information relating to the browser, operating system, screen resolution, selected language, as well as date and time of the visit to the website. This information was transferred to the United States. The Guarantor stated that such processing is not lawful and reiterated that the IP address constitutes personal data and even if it were truncated it would not become anonymous data, given Google's ability to enrich it with other data in its possession. Index of topics • Adopted the first of "a series of measures" • Unlawful transfer of data to the USA with Google Analytics Adopted the first of "a series of measures" At the end of these investigations, the Guarantor adopted the first of a series of measures with which it warned Caffeina Media that manages a website, ordering it to comply with the European Regulation within ninety days. The time indicated was considered adequate to allow the manager to take appropriate measures for the transfer, under penalty of suspension of the data flows carried out, through Google Analytics, to the United States. The Guarantor highlighted, in particular, the possibility, for the US government authorities and intelligence agencies, to access the personal data transferred without the necessary guarantees, noting in this regard that, in light of the indications provided by the EDPB (Recommendation no. 1/2020 of 18 June 2021), the measures that integrate the transfer tools adopted by Google do not guarantee, at present, an adequate level of protection of users' personal data. Unlawful transfer of data to the USA with Google Analytics On this occasion, the Authority drew the attention of all Italian managers of websites, public and private, the illegality of transfers made to the United States through Google Analytics, also in consideration of the numerous reports and questions that are reaching the Office. The Guarantor has invited all data controllers to verify the compliance of the methods of use of cookies and other tracking tools used on its websites, with particular attention to Google Analytics and other similar services, with the legislation on the protection of personal data. At the end of the 90-day period assigned to the recipient company of the measure, the Guarantor will proceed, also on the basis of specific inspection activities, to verify the compliance with the EU Regulation of the data transfers made by the owners.