Italian watchdog bans use of Google Analytics
1–10 of 614 posts
Re: Italian watchdog bans use of Google Analytics
#2What is a watchdog in this case, isn't it a non-governmental organization?
in that case how can they ban anything and what does that mean?
Re: Italian watchdog bans use of Google Analytics
#3What is a watchdog in this case, isn't it a non-governmental organization? in that case how can they ban anything and what does that mean?
This is an English translation from "Garante" which is actually a stronger word - more like Guarantor. It is an official authority with teeth.
Re: Italian watchdog bans use of Google Analytics
#4From the article:
> A website using Google Analytics (GA) without the safeguards set out in the EU GDPR violates data protection law because it transfers users’ data to the USA, which is a country without an adequate level of data protection.
> Upon expiry of the 90-day deadline set out in its decision, the Italian SA will check that the data transfers at issue are compliant with the EU GDPR, including by way of ad-hoc inspections.
This follows similar decisions by France [1] and Austria [2].
[1] https://iapp.org/news/a/cnil-is-latest-authority-to-rule-goo...
[2] https://iapp.org/news/a/far-reaching-implications-anticipate...
Re: Italian watchdog bans use of Google Analytics
#5What is a watchdog in this case, isn't it a non-governmental organization? in that case how can they ban anything and what does that mean?
It's likely a bad translation.
The Italian SA is the Italian Data Protection Agency (DPA), one of the per-country European regulators https://ec.europa.eu/justice/article-29/structure/data-prote... . Which acts under the GDPR and predecessor data protection laws, and is very explicitly a governmental regulator.
Re: Italian watchdog bans use of Google Analytics
#6This is consistent with decisions from the Austrian and French data protection authorities (DPAs). Note that Google is a Processor (for this product), meaning that Google itself does not violate GDPR, but only the websites that use it.
Following the Schrems II case, the "threat model" used by EU courts on these matters is "American law enforcement can serve a warrant to American companies." Long story short, any processing that Google does after collection is not considered to offer any protection, because American law enforcement can just tell them not to do that and they won't. Hence, the "Anonymize IP Address" setting in Google Analytics is not considered to have value for GA.
It might theoretically be possible to use GA compliantly by proxying data through an EU-owned service which obfuscates anything considered personal data, at minimum the IP address and various cookie values. This scenario hasn't been confirmed by anyone as compliant, but the regulators seem to always go out of their way to dance around it rather than just saying "GA is non-compliant, always, forever." Still, for the trouble to set up such a service you might as well just stand up a self-hosted first-party analytics solution.
This particular decision on GA is purely about the cross-border transfers, and doesn't seem to touch on whether using cookies for analytics requires consent. That's a separate issue (technically about a separate law).
Re: Italian watchdog bans use of Google Analytics
#7What is a watchdog in this case, isn't it a non-governmental organization? in that case how can they ban anything and what does that mean?
This is an English translation from "Garante" which is actually a stronger word - more like Guarantor. It is an official authority with teeth.
Exactly. Just to clarify, this is the authority responsible for those multi-million dollars fines against faang
Re: Italian watchdog bans use of Google Analytics
#8What is a watchdog in this case, isn't it a non-governmental organization? in that case how can they ban anything and what does that mean?
Certainly in UK English we use watchdog to mean any organisation that has an oversight role, frequently government ones. For example the Financial Services Authority might be described as “the banking watchdog”, it is very much a government agency.
Re: Italian watchdog bans use of Google Analytics
#9This is consistent with decisions from the Austrian and French data protection authorities (DPAs). Note that Google is a Processor (for this product), meaning that Google itself does not violate GDPR, but only the websites that use it. Following the Schrems II case, the "threat model" used by EU courts on these matters is "American law enforcement can serve a warrant to American companies." Long story short, any proc…
> meaning that Google itself does not violate GDPR, but only the websites that use it.
This is so baffling to me. Google has subsidiaries in the EU. The fact that it's ok to give a product to a EU client which can't be used in accordance with the law, and the client is responsible, is just idiotic.
Re: Italian watchdog bans use of Google Analytics
#10What is a watchdog in this case, isn't it a non-governmental organization? in that case how can they ban anything and what does that mean?
Why do you think watchdogs have to be non-governmental?
For example:
https://www.theguardian.com/technology/2022/may/05/uk-watchd...