“Under the accountability principle, both Google and the EU data controller using Google Analytics could and should take additional safeguards to make the data transfer lawful. To date, according to Malgieri, the measures proposed by Google Analytics are considered inadequate. Google Analytics helps publishers understand how well their sites and apps work for their visitors, but not by identifying people or tracking them across the web. In fact, there are other organizations that control what data is collected and how it is used with these tools outside of Google.
Google helps by providing a variety of safeguards, controls netherlands phone data and compliance resources, A Google spokesperson told EURACTIV. The authority gave the data controller in question 90 days to adapt its website to EU data protection rules. For the Supervisor, this means stopping the use of Google Analytics altogether, as no safeguards can be put in place to prevent US intelligence services from accessing EU personal data. If, in the end, it is really clear that Google Analytics cannot be used in compliance with data protection regulations – and perhaps even no company can rely on standard contractual clauses lawfully, this would have drastic consequences: both for EU websites than for US companies.
But there could still be (at least) two ways out: First, the new US administration under Biden may decide to change US laws. Furthermore, the US and the EU may soon find a common solution in the sense of a new transatlantic data protection agreement. However, one thing is becoming increasingly clear: the transfer of personal data between the EU and the US urgently needs a legally secure basis.