According to France’s watchdog CNIL, Google Analytics, the world’s most widely used web analytics program built by Alphabet’s Google (GOOGL.O), risks allowing U.S. intelligence services access to data from French website users.
The data privacy regulator — one of the most vocal and influential in Europe — said the U.S. tech giant hadn’t taken enough steps to ensure data privacy rights under European Union regulation when data was transferred between Europe and the United States in a decision targeting an unnamed French website manager.
“These (measures) are not sufficient to exclude the accessibility of this data to U.S. intelligence services,” the regulator said in a statement.
“There is, therefore, a risk for French website users who use this service and whose data is exported.”
The CNIL stated the French website manager in question had one month to comply with EU regulations, and that similar orders had been given to other website operators.
The CNIL ruling was met with silence by Google. Google Analytics does not track people throughout the Internet, according to the company, and users of the service have complete discretion over the data they collect.
Following objections from Vienna-based noyb (Non Of Your Business), an advocacy group formed by Austrian lawyer and privacy activist Max Schrems, who won a high-profile lawsuit with Europe’s top court in 2020, the CNIL made a similar judgment.
Because of similar concerns, the European Union’s Court of Justice canceled the Privacy Shield, a transatlantic data transfer agreement used by thousands of enterprises for services ranging from cloud infrastructure to payroll and banking.
Because of the legal dangers they face, several prominent businesses, notably Google and Meta’s Facebook (FB.O), have asked for a new transnational data transfer treaty to be quickly agreed upon.
“In the long run we either need proper protections in the United States, or we will end up with separate products for the US and the EU,” Schrems said in reaction to CNIL’s decision.
“I would personally prefer better protections in the US, but this is up to the US legislator – not to anyone in Europe.”
