Live data from Hacker News

Austria's data protection authority has found that Google Analytics is illegal

tutanota.com

11–20 of 237 posts

Re: Austria's data protection authority has found that Google Analytics is illegal

#11
post #2

The article seems to suggest that it's declared illegal in Austria. Does this somehow apply to the whole EU then?

If something is illegal under GDPR it is illegal in whole of EU.

GDPR is a set of minimum standards that are common between countries in EU, some have even more drastic laws.

Re: Austria's data protection authority has found that Google Analytics is illegal

#12
post #7

To be clear, the transfer of EU citizen's data to the US was deemed against the GDPR. This decision does not mean that Google Analytics itself is illegal.

I think the syllogism comes from the fact that currently GA does transfer EU data to the US by default (and probably currently there is no way to prevent that?). But I'm not a GA expert at any rate so I can be totally wrong.

Re: Austria's data protection authority has found that Google Analytics is illegal

#14
post #2

The article seems to suggest that it's declared illegal in Austria. Does this somehow apply to the whole EU then?

EU laws come in a couple of variants. The most common is a directive which is basically "Your country needs to pass a law to achieve X, Y, Z", and this is where you get larger country to country differences in interpretation. The GDPR is instead a regulation. That means it's literally the same law (and theoretically, the same standards) that applies EU wide. So the US equivalent would be a court in Texas finding something to be illegal under a federal law. What does that mean for the same action in california? It's probably illegal there too, but it could still be tested if someone wanted to try their luck.

So that means the current status is that's precedent a court in another EU country would strongly consider but technically could come to a different decision on and in either case the losing party has the option of appealing to the EU level.

Re: Austria's data protection authority has found that Google Analytics is illegal

#15
post #7

To be clear, the transfer of EU citizen's data to the US was deemed against the GDPR. This decision does not mean that Google Analytics itself is illegal.

But, due to American intelligence agencies explicit access to overseas data (Schrems II), any such service by an American company can't meet the requirements set forth by the EU, and thus can be considered illegal for any practical purpose.

Re: Austria's data protection authority has found that Google Analytics is illegal

#17
As far as I understand it, it's not Google Analytics per se that is illegal, but the data transfer to the US. If Google Analytics would use servers on European ground it should be fine.

Or would that still violate GDPR as Google as an American company can still be coerced to give access to data stored on their servers outside the US? But I can't imagine that to be the case, as it would effectively mean that any business where an American company stores user data is illegal.

Re: Austria's data protection authority has found that Google Analytics is illegal

#18
post #2

The article seems to suggest that it's declared illegal in Austria. Does this somehow apply to the whole EU then?

I think if you view it from this angle it becomes clearer:

The court has not arbitrarily declared GA illegal, it just follows what the GDPR mandates - and came to the (quite obvious) conclusion that GA is not compatible with the GDPR.

Consequently it is illegal everywhere where the GDPR applies. This doesn't mean that there are immediate consequences for those who use GA on their websites in any other country, but it is very likely that other EU countries' courts will decide the same way.

Re: Austria's data protection authority has found that Google Analytics is illegal

#20
post #10

I really hope this will have consequences that shake up ad tech, but the cynic in me says: They're just going to add another disclaimer in their cookie banner and exactly nothing will happen.

Well part of the ruling is that the "standard contractual clauses", basically an attempt to contract away the regulation is not valid. From the article, it seems to be just conceptually, which gels with my understanding of the GDPR, so it's not going to be just adjusting/appending the legal wording in the TOS to fix that.
Post reply on HN