Decision ordering the company
to comply
(No. )
The Chair of the Commission Nationale de l’Informatique et des Libertés (CNIL),
Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of
27 April 2016 on the protection of natural persons with regard to the processing of personal
data and the free movement of such data, in particular Articles 56 and 60;
Having regard to the French Data Protection Act No. 78-17 of 6 January 1978, as amended,
particularly Article 20;
Having regard to Decree No. 2019-536 of 29 May 2019 implementing French Data Protection
Act No. 78-17 of 6 January 1978;
Having regard to Deliberation No. 2013-175 of 4 July 2013 adopting the internal rules of
procedure of the CNIL (French Data Protection Agency);
Having regard to Decision No. 2020-256C of 12 October 2020 of the Chair of the CNIL
instructing the General Secretary to carry out, or have carried out, an audit of the data processing
activities accessible from the domain ' ' or concerning personal data collected from this
domain;
Having regard to referral No. ;
Having regard to the other exhibits;
I. The procedure
(hereinafter "the company" or "), whose
registered office is , was
established in to perform a distance selling activity.
On 19 August 2020, the Commission nationale de l'informatique et des libertés (French data
protection authority, hereinafter "CNIL") received a complaint (no. ) relating to the
transfer of personal data of the complainant (represented by
), to the United States of America, collected during his visit to the
website . has filed 101 complaints in the 27 Member States of the
European Union and the three other members of the European Economic Area (EEA) against
101 data controllers alleged to transfer personal data to the United States.
Pursuant to decision of the CNIL Chair dated , a CNIL
delegation carried out a documentary audit by sending a questionnaire to
on and a request for further information on
. The company replied in letters .
1
The questionnaires concerned the transfer of data of visitors to the French language version of
the website , which uses the Google Analytics service.
, the company informed the CNIL that it had decided to integrate the
Google Analytics functionality on its website and that the statistics
obtained via Google Analytics concerned individuals in several member states of the European
Union. The processing activity resulting from the integration of the Google Analytics
functionality on its website therefore appears to meet the definition of cross-border processing
within the meaning of Article 4.23.b) of the GDPR.
Pursuant to Article 56 of Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016 (hereinafter the "GDPR" or the "Regulation"), , the
CNIL informed all European supervisory authorities of its competence to act as lead authority
regarding the cross-border processing implemented by the company, this competence deriving
from the fact that the company's principal place of business is located in France.
Within the meaning of Article 4, point 22 of the GDPR, data protection authorities are
concerned, namely the authorities
.
On 4 January 2022, as part of the cooperation procedure, a draft decision was submitted to the
authorities concerned on the basis of Article 60 of the GDPR.
This draft decision did not give rise to any relevant and reasoned objections.
II. On the data processing in question and the responsibility for processing
The responses sent to the audit delegation revealed that
the company integrated the Google Analytics feature on the website for
the purpose of measuring its audience and the performance of the company's media campaigns.
The company stated that Google Analytics notably enabled the tracking of an individual if the
user had not refused such use. Indeed, by combining a user's unique identifier with that user's
data from one or more sessions initiated from one or more devices, Google Analytics is able to
obtain more accurate details of users (by identifying a user as an individual user, even in a
different session).
Google Analytics works by including a piece of JavaScript code on the pages of a website.
When a user visits a webpage, this code triggers the uploading of a JavaScript file and then
2
performs the tracking operation for Google Analytics. The tracking operation consists of
recovering data relating to the query through various means and sending this information to the
Google Analytics servers.
Website managers who integrate the Google Analytics service may send instructions to Google
for the processing of data collected through Google Analytics. These instructions are
transmitted through the tag manager that manages the tracking code they have integrated into
their website and through the tag manager settings. The website manager can apply different
settings, for example, regarding the data retention period. The Google Analytics feature also
allows website managers to monitor and maintain the stability of their website, for example by
keeping them informed of certain events such as a peak in audience or the fact that there is no
traffic at all. Google Analytics also allows website managers to measure and optimise the
effectiveness of advertising campaigns conducted using other Google tools.
In this context, Google Analytics collects the user's http query and information about the user's
browser and operating system, among other things. an http request, for any
page, contains details of the browser and the device making the query, such as the domain name
and browser information such as its type, referer, and language. Google Analytics stores and
reads cookies on the user's browser to evaluate the user's session and other information on the
query.
When this information is collected, it is transmitted to the Google Analytics servers.
all data collected through Google Analytics are hosted in the United States.
Thus, data collected on the website via Google Analytics are transferred to the United
States.
As regards these transfers, it appears from the exhibits that the contract
concerning the Google Analytics feature refers to an appendix
entitled Google Ads Data Processing Terms. This appendix contains standard contractual
clauses governing the transfer of personal data to the United States of America under the Google
Analytics service. The company indicated that it had no evidence in its possession to consider
that these clauses had not been complied with.
it has implemented additional legal, organisational and technical measures
to regulate data transfers under the Google Analytics service.
All of these elements show that, by deciding to implement the Google Analytics feature on this
website for evaluation and optimisation purposes, the company managing the website
determined the means and purposes of the collection and processing of
the data obtained further to the integration of Google Analytics on its website and should be
considered the data controller within the meaning of Article 4.7 of the GDPR.
III. On the qualification of personal data
It can be established that the data collected under the Google Analytics feature and transferred
to the United States of America constitute personal data.
Article 4.1 of the GDPR defines personal data as "any information relating to an identified or
identifiable natural person ('data subject'); an identifiable natural person is one who can be
3
identified, directly or indirectly, in particular by reference to an identifier such as a name, an
identification number, location data, an online identifier or to one or more factors specific to
the physical, physiological, genetic, mental, economic, cultural or social identity of that natural
person."
It should be noted that online identifiers, such as IP addresses or information stored in cookies
can commonly be used to identify a user, particularly when combined with other similar types
of information. This is illustrated by Recital 30 GDPR, according to which the assignment of
online identifiers such as IP addresses and cookie identifiers to natural persons or their devices
may "leave traces which, in particular when combined with unique identifiers and other
information received by the servers, may be used to create profiles of the natural persons and
identify them." In the particular case where the controller would claim to not have the ability to
identify the user through the use (alone or combined with other data points) of such identifie rs,
he would be expected to disclose the specific means deployed to ensure the anonymity of the
collected identifiers. Without such details, they cannot be considered anonymous.
Therefore, it is necessary to examine to what extent the implementation of Google Analytics
on a website allows the website manager and to render a data subject (a visitor of the
website in question) identifiable.
In its reply, states that the following categories of
personal data are processed under the Google Analytics feature:
- a visitor's identifier (the identifier of the Google Analytics visitor cookie, i.e. the Google
Analytics customer ID);
- for visitors who have logged into the website through a user account, an internal
identifier;
- the order identifiers, if any;
- IP addresses.
The company asserts that IP addresses are 'anonymised', without specifying what process is
used to make these addresses anonymous. However, the company describes these data as
personal data.
With regard to visitor identifiers, it should be noted that these are unique identifiers intended to
differentiate individuals. In the present case, these identifiers may also be combined with other
information, such as the address of the website visited, metadata relating to the browser and
operating system, the time and data relating to the visit to the website, and the IP address. This
combination of information further differentiates individuals.
For this reason, when several elements are combined, they can make it possible to individually
identify visitors to the website, on which Google Analytics is implemented. It is not
required to know the actual visitor's name or (physical) address since, in accordance with recital
26 of the GDPR, such singling out of individuals is sufficient to make the visitor identifiable.
Should it be decided otherwise, the scope of the right to data protection, guaranteed by Article
8 of the Charter of Fundamental Rights of the European Union, would be undermined as it
would allow companies to specifically single out individuals along with personal information
(such as when they visit a specific website) while denying them any right of protection against
such singling out. Such a restrictive view that would undermine the level of protection of
4
individuals is also not line with the case law of the Court of Justice of the European Union,
which repeatedly ruled that the scope of the GDPR has to be understood in a very wide manner
(see, for example, C-439/19, paragraph 61).
The CNIL further notes that for users of the website who have identified themselves
through a user account, or those who have placed an order, the data can be directly connected
with identifying data.
Moreover, in the context of using Google Analytics,
and under some Google account settings, Google is informed that a user connected to a Google
account has visited a particular website. Personal data relating to this account are therefore
collected.
As a result, it must be considered that the data in question should be regarded as personal data
within the meaning of Article 4 of the GDPR.
IV. On the breach of the obligation to regulate transfers of personal data outside the
European Union
Article 44 of the GDPR states: "Any transfer of personal data which are undergoing processing
or are intended for processing after transfer to a third country or to an international
organisation shall take place only if, subject to the other provisions of this Regulation, the
conditions laid down in this Chapter are complied with by the controller and processor,
including for onward transfers of personal data from the third country or an international
organisation to another third country or to another international organisation. All provisions
in this Chapter shall be applied in order to ensure that the level of protection of natural persons
guaranteed by this Regulation is not undermined."
Chapter V of the Regulation provides for various tools to ensure a level of protection
substantially equivalent to that guaranteed within the European Union, pursuant to Article 44
of the Regulation:
- adequacy decisions (Article 45);
- appropriate safeguards (Article 46);
In the absence of an equivalent level of protection, it establishes derogations for specific
situations (Article 49).
In the present case, it must be verified whether the export of personal data to the United States
of America comply with Article 44 GDPR and, in particular, whether the export was based on
one of these grounds, and if it was, if the relevant measures were taken.
4.1 Adequacy decisions
In its judgement of 16 July 2020 (C-311/18), the Court of Justice of the European Union
invalidated Commission Implementing Decision (EU) 2016/1250 of 12 July 2016, in
accordance with Directive 95/46/EC of the European Parliament and of the Council on the
adequacy of the protection afforded by the European Union-US Privacy Shield, without
maintaining its effects.
5
In the absence of another relevant adequacy decision, the transfers in question may not be based
on Article 45 of the GDPR.
4.2 Appropriate safeguards
Article 46.1 of the Regulation provides that "In the absence of a decision pursuant to Article
45(3), a controller or processor may transfer personal data to a third country or an
international organisation only if the controller or processor has provided appropriate
safeguards, and on condition that enforceable data subject rig hts and effective legal remedies
for data subjects are available."
Article 46.2 of the Regulation provides that "The appropriate safeguards referred to in
paragraph 1 may be provided for, without requiring any specific authorisation from a
supervisory authority, by: […] (c) standard data protection clauses adopted by the Commission
in accordance with the examination procedure referred to in Article 93(2)."
4.2.1 Standard data protection clauses
In the present case, the company and Google have entered into standard contractual clauses for
the transfer of personal data to the United States (Google Ads Data Processing Terms: Model
Contract Clauses, Standard Contractual Clauses for Processors). These clauses are in line with
those published by the European Commission in Decision 2010/87/EU.
In this context, it must be emphasised that standard contractual clauses are a transfer tool within
the meaning of Chapter V of the Regulation and were not challenged as such by the Court of
Justice in its judgement of 16 July 2020 (C-311/18). However, the Court considered that it
stemmed from the contractual nature of these clauses that they could not be binding on the
authorities of third countries. In particular, the Court held that: "Therefore, although there are
situations in which, depending on the law and practices in force in the third country concerned,
the recipient of such a transfer is in a position to guarantee the necessary protection of the data
solely on the basis of standard data protection clauses, there are others in which the content of
those standard clauses might not constitute a sufficient means of ensuring, in practice, the
effective protection of personal data transferred to the third country concerned. That is the
case, in particular, where the law of that third country allows its public authorities to interfere
with the rights of the data subjects to which that data relates" (C-311/18, point 126, emphasis
added).
A further analysis of the legal situation of the USA is not required though, as the CJEU has
already provided such analysis in its aforementioned judgement. Indeed, the Court found that
the surveillance programmes in question do not correlate to the minimum safeguards arising
from the principle of proportionality under Union law, such that the surveillance programmes
based on these provisions cannot be regarded as limited to what is strictly necessary (point 184).
Moreover, the Court found that the legal framework in question did not confer on data subjects
rights actionable in the courts against the US authorities, from which it follows that these
persons have no right to an effective remedy (point 192).
The analysis of the CJEU is relevant in the present case, since Google LLC (as importer of the
data to the USA) is to be qualified as a provider of electronic communications services within
the meaning of 50 US. Code § 1881(b)(4) and is therefore subject to surveillance by US.
intelligence services in accordance with 50 US. Code § 1881a (“FISA 702”). Google LLC
6
therefore has the obligation to provide the US government with personal data when requested
FISA 702.
As can be seen in the Google Transparency Report, Google LLC is regular subject to such
access requests by US. intelligence services.
Considering the fact that the Court of Justice declared the adequacy decision with the United
States of America invalid due to the access possibilities of US intelligence services, and the fact
that the conclusion of SCCs cannot by themselves ensure a level of protection as required by
Article 44 GDPR as the guarantees they provide are left unapplied when such access requests
are taking place. Indeed, the CJEU concluded the following: "It follows that the standard data
protection clauses adopted by the Commission on the basis of Article 46(2)(c) of the GDPR are
solely intended to provide contractual guarantees that apply uniformly in all third countries to
controllers and processors established in the European Union and, consequently,
independently of the level of protection guaranteed in each third country. In so far as those
standard data protection clauses cannot, having regard to their very nature, provide
guarantees beyond a contractual obligation to ensure compliance with the level of protection
required under EU law, they may require, depending on the prevailing position in a particular
third country, the adoption of supplementary measures by the controller in ord er to ensure
compliance with that level of protection" (point 133).
4.2.2 Implementation of additional safeguards
In its recommendations 01/2020 of 18 June 2021, the European Data Protection Board (EDPB)
has clarified that where the assessment of the law and/or practices in force of the third country
may impinge on the effectiveness of the appropriate safeguards of the transfer tools the exporter
is relying on, in the context of his specific transfer, which is the case here following the
assessment by the CJEU, the exporter has to either suspend the transfer or implement adequate
supplementary measures. The EDPB notes in this respect that "Any supplementary measure
may only be deemed effective in the meaning of the CJEU judgement "Schrems II" if and to the
extent that it – by itself or in combination with others - addresses the specific deficiencies
identified in the assessment of the situation in the third country as regards its laws and practices
applicable to the transfer" (point 75).
Measures to supplement standard data protection clauses can be classified into three categories:
contractual, organisational and technical (see point 47 of Recommendations 01/2020).
With regard to contractual measures, the EDPB noted that such measures: "[…] may
complement and reinforce the safeguards the transfer tool and relevant legislation of the third
country may provide […]. Provided the nature of contractual measures, generally not capable
of binding the authorities of that third country when they are not party to the contract, these
measures may often need to be combined with other technical and organisational measures to
provide the level of data protection required […]" (point 99, emphasis added).
As regards organisational measures, the EDPB highlighted that "[…] Selecting and
implementing one or several of these measures will not necessarily and systematically ensure
that your transfer meets the essential equivalence standard that EU law requires. Depending
on the specific circumstances of the transfer and the assessment performed on the legislation
of the third country, organisational measures are needed to complement contractual and/or
7
technical measures, in order to ensure a level of protection of the personal data essentially
equivalent to that guaranteed within the EEA" (point 128, emphasis added).
With regard to technical measures, the EDPB pointed out that "[…] These measures will be
especially needed where the law of that country imposes on the data importer obligations which
are contrary to the safeguards of Article 46 GDPR transfer tools and are, in particular, capable
of impinging on the contractual guarantee of an essentially equivalent level of protection
against access by the public authorities of that third country to that d ata" (point 77, emphasis
added). It added that "The measures listed [in the guidelines] are intended to ensure that access
to the transferred data by public authorities in third countries does not impinge on the
effectiveness of the appropriate safeguards contained in the Article 46 GDPR transfer tools.
These measures would be necessary to guarantee an essentially equivalent level of protection
to that guaranteed in the EEA, even if the public authorities’ access complies with the law of
the importer’s country, where, in practice, such access goes beyond what is necessary and
proportionate in a democratic society. These measures aim to preclude potentially infringing
access by preventing the authorities from identifying the data subjects, inferring information
about them, singling them out in another context, or associating the transferred data with other
datasets that may contain, among other data, online identifiers provided by the devices,
applications, tools and protocols used by data subjects in other co ntexts" (point 79, emphasis
added).
4.2.3 Supplementary measures implemented by Google
Google LLC, as the data recipient, has adopted contractual, organisational and technical
measures to supplement the standard data protection clauses.
Taking the considerations of the CJEU and the EDPB into account, it must now be verified
whether or not the supplementary measures adopted by Google LLC are effective, meaning
they address the specific issue of access possibilities of US intelligence services.
With regard to the legal and organisational measures adopted, it must be noted that neither the
notification of users – should such notification even be permissible – nor the publication of a
Transparency Report or a publicly available „policy on handling government requests” in fact
prevent or reduce access possibilities of US intelligence services. Furthermore, it remains
unclear how Google LLC’s „careful review of each request” on its permissibility is effective as
supplementary measure, considering that according to the CJEU, permissible (legal) requests
of US intelligence services are not in line with the requirements of the European Data Protection
Law.
With regard to the technical measures adopted, it should be noted that it has not been clarified,
either by Google LLC or by the company, how the measures described – such as the protection
of communications between Google's services, the protection of data in transit between data
centres, the protection of communications between users and websites, or “on-site security” –
in fact prevent or reduce the possibilities of access by US intelligence services on the basis of
the US legal framework.
As far as encryption technologies are concerned – such as for „data at rest” in data centres, as
specifically mentioned by Google LLC as technical measure – it has to be noted that Google
LLC as data importer nonetheless has an obligation to grant access or to turn over import ed
8
personal data in their possession, including any cryptographic keys necessary to render the data
intelligible (see Recommendations 01/2020, point 81). In other words: As long as Google LLC
has the possibility to access the data of natural persons in clear text, such technical measure
cannot be deemed effective in the present case.
As far as Google LLC brings forward that „(t)o the extent Google Analytics Data for
measurement transferred by website owners is personal data, it would have to be regarded as
pseudonymous”, it must be noted that universal unique identifiers (UUIDs) do not fall under
the definition of Article 4.5 of the GDPR. While pseudonymisation may be a privacy-enhancing
technique, the unique identifiers have, as already outlined above, the specific intention to single
out users, not to act as safeguard. Apart from this, it has also been outlined above why the
combination of unique identifiers with other elements (such as browser or device meta data and
the IP-address) and the possibility to link such information to a Google Account in any case
make an individual identifiable.
As far as Google LLC refers to an „Optional Technical Measure“ by means of an IP -
Anonymization function, it must first be noted that such measure is – as the name indicates –
optional and not applicable to all transfers. In addition, it is not clear from Google's response if
this anonymisation takes place before the transfer or if the entire IP address is transmitted to
the United States and only shortened after this transfer to the United States. Thus, from a
technical point of view, there is potential access to the entire IP address before it is shortened.
Therefore, the supplementary measures adopted, as presented by Google, are not effective
insofar as none of them addresses the specific issues in the present case, meaning none of them
prevent access possibilities of US intelligence services or render these accesses ineffective.
4.3. The derogations provided for in Chapter V of the Regulation
Article 49 of the Regulation states "1. In the absence of an adequacy decision pursuant to
Article 45(3), or of appropriate safeguards pursuant to Article 46, including binding corporate
rules, a transfer or a set of transfers of personal data to a third country or an interna tional
organisation shall take place only on one of the following conditions:
(a) the data subject has explicitly consented to the proposed transfer, after having been
informed of the possible risks of such transfers for the data subject due to the absence of an
adequacy decision and appropriate safeguards;
(b) the transfer is necessary for the performance of a contract between the data subject and the
controller or the implementation of pre-contractual measures taken at the data subject's
request; […]"
The company argues that the transfer could be based on Art. 49.1.a of the GDPR by indicating
that data subjects may refuse to allow Google to track their visit to the website.
However, users' consent to the storing of cookies during their visit to the website cannot be
considered as equivalent to their having "explicitly consented to the proposed transfer, after
having been informed of the possible risks of such transfers for the data subject due to the
absence of an adequacy decision and appropriate safeguards" within the meaning of Article
49.1.a of the Regulation. In this regard, it can be noted that the company, far from establishing
9
that such consent has been obtained, does not provide any information relating to these elements
which would be provided to visitors of the website.
The company also invokes Article 49.1.b of the Regulation insofar as these functionalities are
necessary for the proper functioning of the website and the detection of anomalies.
This argument is nevertheless not supported by any specific evidence and, above all, the
company does not establish that there is a contractual relationship between it and all users of its
website.
Consequently, the company cannot invoke Article 49 of the Regulation to justify the data
transfers in question.
4.4. Conclusion
Therefore, it must be concluded that the company cannot invoke any of the tools provided for
in Chapter V of the Regulation to justify the transfer of personal data of visitors to its website,
and in particular unique identifiers, IP addresses, browser data and metadata, to Google LLC in
the United States.
Accordingly, with this transfer of data, the company undermines the level of personal data
protection of data subjects as guaranteed in Article 44 of the GDPR.
Consequently,
is hereby ordered to comply with the following,
within one (1) month of notification of this decision, and subject to any measures it may
have already implemented:
bring the data processing activity under the Google Analytics service into
compliance with Articles 44 et seq. of Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016, notably by ceasing
processing activities which relate to the current version of the tool Google
Analyctics;
provide supporting documentation to the CNIL confirming that the
aforementioned request has been complied with within the time limit.
At the end of that period, if has complied with this
order, it will be considered that these proceedings are closed and a letter will be sent to it
to that effect.
Conversely, if has not complied with this order
notice by the end of that period, a rapporteur will be appointed to request the restricted
committee to issue one of the penalties provided for by Article 20 of the French Data
Protection Act of 6 January 1978, as amended.
The Chair
10
11