Hungarian DPA Ordered a Halt Against Google Analytics Use

Hungarian Data Protection Authority ordered a weather forecast website to stop using Google Analytics. The prohibition resulted from the lack of safeguards for U.S. data transfers as required by Article 46 GDPR.

According to a recentGDPRtoday release (a newsletter by noyb), the Hungarian DPA might soon go against the use of Google Analytics. Furthermore, the DPA of other countries, such as Austria, France, Italy, and Denmark, have already ruled against Google Analytics use. The information is reliably coming from noyb (European Center for Digital Rights), which is directly involved in the case and represents the data subject.

The Facts

A data subject complained about a website controller with the  Hungarian DPA NAIH. The website controller used Google Analytics cookies on its weather forecast site. The data subject alleged the controller to have transferred personal data such as I.P. address to Google Ireland and subsequently to the U.S. Google LLC. According to the data subject, the controller was responsible for preventing personal data transfer to the U.S. based on  Schrems-II judgment.

The DPA has been requested by the data subject to:

• Prohibit any data flows to Google LLC in congruence with Article 58(2)(j) GDPR.
• Impose a fine on the website controller and Google based on Article 83(5)(c) GDPR.

In response, the website controller claimed that it had removed HTML codes or Google Analytics cookies from its website. The controller of the weather forecast website also declined any personal data transfers outside Europe. Nonetheless, during a test, the DPA found the controller's website used three cookies. The cookies were linked to Google's ad service resulting in data transmission to the U.S.

Implications

The DPA assessed the controller's GDPR compliance as it was based in Hungary. According to the E.U. interpretations, I.P. addresses are considered personal data. The DPA asked the controllers to stop the data transfers to a third country or international organization as it was not based on the provisions of Chapter V GDPR. However, the fine could not be imposed based on Hungarian national law.

The rulings are rooted in the Schrems II case, which led to the filing of 101 complaints against Google Analytics. All the complaints strictly call for establishing Schrems II's judgment.

Final Thoughts

The case under discussion is one of the many complaints lodged in 2020 by noyb (a privacy NGO), collectively known as 101 complaints on EU-US transfers. The nature of the complaint is similar to those filed by the Austrian, French, and Italian DPAs. This decision might resemble that of the other three DPAs because of a coordinated approach of DPAs toward 101 complaints. It means the use of Google Analytics will soon become unlawful in Hungary.

What can you do about it? Contrary to Google Analytics, Usermaven respects user privacy while website browsing and is fully GDPR compliant. If you aim to make your website visitor-friendly, try Usermaven for free.