In Germany, where the implementation of personal data protection measures is the responsibility of the individual regions, and not of the Federal Government, several regional authorities have published recommendations regarding the use of instruments such as GOOGLE ANALYTICS. According to these recommendations, the use of the service in question must be subject to the prior consent of the user. The competent authorities have pointed out that when using the services of Google Analytics, the data collected are also transmitted to another recipient (Google), who uses them for its own purposes. It follows that such processing by Google can no longer be considered as a mere activity of the “data processor”.
Under the previous rules, services such as GOOGLE ANALYTICS were considered lawful from the point of view of processing of personal data, even though the processing in question was carried out without the prior consent of the data subjects. In this respect, some German regional authorities (e.g. Hamburg) considered the processing of personal data to be lawful in the absence of consent as long as certain specific requirements were met, such as the following:
– the creation of pseudonymised profiles; – the right of opposition (with an opt-out procedure); – the conclusion of a contract with Google; – the presence of information for the user on the use of Google Analytics; – partial deletion of the IP address in Google’s settings (IP anonymisation).
In many respects, these criteria are similar to the provisions of the Italian Data Protection authority in the directives published in 2014 and 2015.
The decision taken by the Länder was justified by the changes and technical development the product: “Google Analytics has been developed in recent years in such a way that it no longer represents processing as a mere data controller. Rather, the provider is granted the right to use the data of visitors to the websites for its own purposes.”
Since data protection matters are harmonised and since the reasons for the decision taken by the German authorities are based on an analysis of the technical characteristics of the service, it can be assumed that the issue will soon be brought to the attention of other national data protection authorities, with the possible consequence that the prior consent of the data subject will also become a necessary requirement in other EU Member States or – to be more precise – throughout the European Union (so that the various German Länder would in this case act as “forerunners”).