Norwegian supervisory authority Datatilsynet provisionally declares Google Analytics not GDPR-compliant
The Norwegian supervisory authority’s investigation was triggered by a complaint filed by noyb, an organisation founded by Max Schrems, with the data protection authorities in the EEA. This is directed against a number of European websites – including a Norwegian one – which, according to noyb, transfer personal data from the EEA to the USA by using Google Analytics and thus act against the General Data Protection Regulation (GDPR).
Although Norway is not a EU member, the decision of the Norwegian supervisory authority is highly relevant in Germany and throughout the EU. Because as a member of the European Economic Area (EEA), Norway has also introduced the GDPR. And so, in the context of the complaint about Google Analytics, the data protection authority Datatilsynet points out that it will coordinate with the other European supervisory authorities across borders. These would have the right to appeal within one month if they do not agree with the Norwegian assessment. After that, the Norwegian data protection authority will make a final decision on the use of Google Analytics. And thus the decision will not only apply in Norway, but will be the consensus in all countries of the EU plus Norway, Liechtenstein and Iceland. For according to the announcement by Datatilsynet:
“Because there are so many complaints about the use of Google Analytics at the European level, the European Data Protection Board (EDPB) has set up its own working group to coordinate the handling of complaints. Data protection authorities are required to interpret the GDPR consistently across the EEA.”
(https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/varsel-om-vedtak-i-google-analytics-saken/)
“A clear European consensus has emerged on the use of Google Analytics, says section head Tobias Judin at the Norwegian Data Protection Authority. The data protection authorities in Austria, France and Italy as well as the data protection authority of the EU institutions (EDPS) have already decided that the use of Google Analytics violates data protection regulations. Incidentally, the Danish data protection authority draws the same conclusion in a guide on the subject, and the data supervisory authority in Liechtenstein has also expressed criticism of the tool.”
(https://www.datatilsynet.no/aktuelt/aktuelle-nyheter-2023/varsel-om-vedtak-i-google-analytics-saken/)
Thus, a contrary assessment by the EDPB is rather unlikely. A final decision will be made at the end of April to the beginning of May.
By the way, the Norwegian as well as the Danish supervisory authority sees the GDPR problems equally for Google Universal Analytics as for Google Analytics 4.
We will keep you posted on the final ruling.
(Translations from Norwegian by the author)