11 November 2013

Google introduces data processing agreement for Google Analytics

The Dutch Data Protection Authority published its opinion on 22 August 2013 on the use of Google Analytics as part of its findings in relation to Smart TVs.

This information is available in English only.

The Dutch Data Protection Authority (College bescherming persoonsgegevens; “CBP“) published its opinion on 22 August 2013 on the use of Google Analytics as part of its findings in relation to Smart TVs. In its findings, the CBP considers that Smart TV and website operators that use third-party analytics providers (such as Google Analytics) may require a data processing agreement be entered into. According to the CBP, this applies when those third-party providers process personal data (e.g., because IP addresses are used to provide the analytics service).

The investigation’s subject used Google’s Analytics service and did not have a data processing agreement in place with Google. When the subject requested Google to conclude a data processing agreement, Google referred to its standard terms and conditions and refused to enter into a separate data processing agreement with Dutch Smart TV and website operators, although it did offer this option to German Smart TV and website operators. The CBP concluded that Google’s standard terms and conditions did not contain the provisions required to establish a lawful data processor relationship. Therefore, Dutch Smart TV and website operators that used Google Analytics subject to these terms act in violation of the Dutch Data Protection Act.

Following publication of these findings, Google has now introduced the possibility for all website operators in the entire European Economic Area Union, Iceland, Norway and Switzerland to conclude data processing agreements for the use of its Analytics product. The data processing agreement can be viewed and concluded in the “Account Settings” of the Google Analytics dashboard (please see the screenshot below). It is questionable whether the new separate data processing agreement is in fact compliant with Dutch data protection legislation. Ultimately, it is up to the CBP to confirm its compliance.

 

Snip Emre