Following the annulment of the Privacy Shield in the CJEU’s Schrems II ruling, the French personal data authority, the CNIL, gave notice on 10 February 2022 to a website manager to come into compliance with Articles 44 et seq. of the GDPR, if necessary by stopping its use of Google Analytics. The use of the Google Analytics tool leads to the transfer of personal data to the United States. The CNIL judged contrary to the GDPR and principles and obligations regarding the transfers outside the European Economic Area by the use of the Google Analytics tool because the appropriate guarantees for complying with the GDPR are not in place during those transfers. The website manager has one month to remedy the situation.

In early 2022, the Datenschutzbehörde (DSB), the Austrian data protection authority also decided that the use by a website of the Google Analytics tool was contrary to the GDPR.

In total, 101 complaints have been filed throughout the European Union by the personal data defense group NOYB.eu. To be continued…

For more information on the CNIL and DSB decisions: