https://www.imy.se/en/news/companies-must-stop-using-google-analytics/ Skip to content Menu Menu * Individuals Individuals [dataskydds] Data protection [kamerabeva] Camera surveillance [inkasso] Debt recovery [kredituppl] Credit information [utfora-are] Forms and e-services About IMY + Om oss + Vart uppdrag * Organisations Organisations ----------------------------------------------------------------- [dataskydds] Data protection [kamerabeva] Camera surveillance [inkasso] Debt recovery [kredituppl] Credit information [utfora-are] Forms and e-services About IMY + Om oss + Vart uppdrag * ----------------------------------------------------------------- ( ) ( ) ( ) ( ) ( ) ( ) Menu Main menu Menu Main menu * Individuals Individuals * Organisations Organisations ----------------------------------------------------------------- * ----------------------------------------------------------------- [dataskydds] Data protection [kamerabeva] Camera surveillance [inkasso] Debt recovery [kredituppl] Credit information [utfora-are] Forms and e-services About IMY * Om oss * Lediga jobb * Vart uppdrag * Utbildningar och konferenser [dataskydds] Data protection [kamerabeva] Camera surveillance [inkasso] Debt recovery [kredituppl] Credit information [utfora-are] Forms and e-services About IMY * Om oss * Lediga jobb * Vart uppdrag * Utbildningar och konferenser ( ) ( ) ( ) ( ) * Individuals Individuals * Organisations Organisations * Individuals Individuals * Organisations Organisations --------------------------------------------------------------------- icon Data protection icon Camera surveillance icon Debt recovery icon Credit information * Payment default records icon Forms and e-services * Complain about incorrect processing of your personal data * Complain about unlawful camera surveillance * How to request a lawfulness check icon Data protection * This applies accordning to GDPR + The purposes and scope of GDPR o Personal data # Sensitive personal data + The GDPR fundamental principles + Lawful grounds for personal data processing + The data subject's rights + Privacy by design and privacy by default + Data controllers and data processors + Maintain a processing record + Information security + Impact assessments and prior consultation + Data protection officers + Codes of conduct and certification + Transfer of data to a third country + Cross-border processing * Personal data within law enforcement icon Camera surveillance * For those considering the use of video-surveillance * Video-surveillance of employees * Inform about your video-surveillance icon Debt recovery * Apply for a permit to operate debt-collection activities + Change of legal and/or judgement expert + Application for renewal of debt collection permit * About licences to collect debt icon Credit information icon Forms and e-services * Announce that you have a data protection officer * Notification of a personal data breach * Apply for a permit to operate debt-collection activities + Application for renewal of debt collection permit + Change of legal and/or judgement expert * Apply for a credit reference licence Contact us Dictionary Listen Stop listening Pa svenska About IMY * About us + Contact us + Current events + Our mission o Questions outside the scope of our assignment + Organisation * Lediga jobb * Our mission + Questions outside the scope of our assignment * Utbildningar och konferenser * Contact us * Listen Stop listening * Pa svenska --------------------------------------------------------------------- Search {{scopeSlot.suggestion.item.query}} What are you searching for today? There are 0 suggestions. Use the arrow keys to navigate the suggestions Clear Search Search suggestions! * Om IMY * Dataskyddsforordningen i fulltext * Tillsyner och beslut ( ) ( ) --------------------------------------------------------------------- Search Search What are you searching for today? [ ] Clear Search Search suggestions! * Om IMY * Dataskyddsforordningen i fulltext * Tillsyner och beslut Start News in English Four companies must stop using Google Analytics Svensk version Listen Four companies must stop using Google Analytics Published: 3 July 2023 The Swedish Authority for Privacy Protection (IMY) has audited how four companies use Google Analytics for web statistics. IMY issues administrative fines against two of the companies. One of the companies has recently stopped using the statistics tool on its own initiative, while IMY orders the other three to also stop using it. IMY has audited how four companies transfer personal data to the US via Google Analytics, which is a tool for measuring and analysing traffic on websites. The companies audited are CDON, Coop, Dagens Industri and Tele2. The audits concerns a version of Google Analytics from 14th of August 2020. The audits are based on complaints from the organisation None of Your Business (NOYB) in the light of the Schrems II ruling by the European Court of Justice (CJEU). The complaints allege that the companies, in violation of the law, transfer personal data to the United States. According to the data protection regulation, GDPR, personal data may be transferred to third countries, i.e. countries outside the EU/EEA, if the European Commission has decided that the country in question has an adequate level of protection for personal data that corresponds to that within the EU/EEA. However, the CJEU ruled through the Schrems II ruling that the United States could not be considered to have such an adequate level of protection at the time of the ruling. In its audits, IMY considers that the data transferred to the US via Google's statistics tool is personal data because the data can be linked with other unique data that is transferred. The authority also concludes that the technical security measures that the companies have taken are not sufficient to ensure a level of protection that essentially corresponds to that guaranteed within the EU/EEA. - By the fact that IMY has decided on these cases at the same time, it is made clear what requirements are placed on technical security measures and other measures when transferring personal data to a third country, in this case the United States, says legal advisor Sandra Arvidsson, who led the audits of the companies. If there is no decision on an adequate level of protection by the European Commission, data may be transferred based on standard contractual clauses that the European Commission has decided on. However, according to the CJEU, such standard contractual clauses may need to be supplemented with additional safeguards if it is necessary for the protection that the clauses are intended to provide to be maintained in practice. All four companies have based their decisions on the transfer of personal data via Google Analytics on standard contractual clauses. From IMY's audits, it appears that none of the companies' additional technical security measures are sufficient. IMY issues an administrative fine of 12 million SEK against Tele2 and 300,000 SEK against CDON, which has not taken the same extensive protective measures as Coop and Dagens Industri. Tele2 has recently stopped using the statistics tool on its own initiative. IMY orders the other three companies to stop using the tool. - These decisions have implications not only for these four companies, but can also provide guidance for other organisations that use Google Analytics, says Sandra Arvidsson. The decisions Related links * Read the decision against CDON in Swedish (pdf, 433 kB) * Read the decision against Coop in Swedish (pdf, 423 kB) * Read the decision against Dagens Industri in Swedish (pdf, 746 kB) * Read the decision against Tele2 in Swedish (pdf, 399 kB) For more information contact Legal advisor Sandra Arvidsson, telephone 08-515 154 14 Press service, telephone 08-515 15 415 Latest update: 4 July 2023 Print Page labels Data protection More news on this topic * Administrative fee against Spotify 13 June 2023 ----------------------------------------------------------------- * Data protection officers point to problems applying GDPR 31 January 2023 ----------------------------------------------------------------- * Administrative fine against Klarna after investigation 31 March 2022 ----------------------------------------------------------------- * Administrative fine to the Swedish Customs for deficient routines 16 March 2022 ----------------------------------------------------------------- See more news More news on this topic * Administrative fee against Spotify 13 June 2023 ----------------------------------------------------------------- * Data protection officers point to problems applying GDPR 31 January 2023 ----------------------------------------------------------------- * Administrative fine against Klarna after investigation 31 March 2022 ----------------------------------------------------------------- * Administrative fine to the Swedish Customs for deficient routines 16 March 2022 ----------------------------------------------------------------- See more news Latest update: 4 July 2023 Print Page labels Data protection About IMY * Om oss * Vart uppdrag IMY (to startpage) Contact us Phone: 08-657 61 00 E-mail: imy@imy.se * How to contact us About our site * Cookies * How we process personal data * About this website Follow us LinkedIn Twitter RSS