Recently, an Austrian Data Protection Authority (DPA) determined that the use of Google Analytics by a local website violates GDPR as there is a risk that U.S. intelligence agencies may get access to user data. This also led to a Dutch authority stating that it is investigating two similar claims in Netherlands and it will soon issue a decision about whether it will ban Google Analytics or not. In light of these events, Google has now published a blog post emphasizing the need for a robust EU-US data transfer framework.
Google has noted that the global scale of online business and the ability to share information via data flows brings major benefit to economies. It claims that the spread of high-value media and information services will facilitate the influx of billion of euros to the EU alone in the years to come. As such, there is a need for a robust framework for EU-US data flows as soon as possible.
Commenting on the Austrian DPA"s decision, Google expressed disapproval saying that it has been providing its Analytics service to businesses around the globe for the past 15 years, and never has it received a request from U.S. intelligence agencies to share Google Analytics data. It doesn"t expect such a request to arrive anytime soon either given the stringent laws around the area.
Google also highlighted that it already offers several supplementary measures for customers to protect their data. And while the Austrian ruling only affects one publisher right now, it fears that this leads to slippery slope where a theoretical risk results in businesses being unable to use Google Analytics. The tech company has emphasized this to be a risk to the global economy.
As such, Google has proposed that an EU-US data flow framework to protect the respective interests of all involved should be developed soon, saying that:
The stakes are too high — and international trade between Europe and the U.S. too important to the livelihoods of millions of people — to fail at finding a prompt solution to this imminent problem.
A durable framework — one that provides stability for companies offering valuable services in Europe — will help everyone, at a critical moment for our economies. A new framework will bolster the transatlantic relationship, ensure the stability of transatlantic commerce, help businesses of all sizes to participate in the global digital economy, and avoid potentially serious disruptions of supply chains and transatlantic trade. And it will assure continued protection of people’s right to privacy on both sides of the Atlantic.
We strongly support an accord, and have for many years supported reasonable rules governing government access to user data. We have long advocated for government transparency, lawful processes, and surveillance reform. We were the first major company to create a Transparency Report on government requests for user data, were founding members of the Global Network Initiative and the Reform Government Surveillance coalition, and support the OECD’s workstream on government access to data. At this juncture, we urge both governments to take a flexible and aligned approach to resolving this important issue.
Regardless of whether governments heed its urgent call for such a framework, Google says that it will continue to ensure data protection practices at the highest level across all its products.