Patrice Navarro and Julie Schwartz of Hogan Lovells write:
Following complaints from the NOYB association regarding the use of the Google Analytics audience measurement solution, the French Data Protection Authority (CNIL) had issued several formal notices to French companies using this solution on their websites. These decisions were issued in the context of other decisions from European data protection authorities, and following the European Court of Justice’s (ECJ) Schrems II ruling invalidating the Privacy Shield and imposing additional assessment obligations when using Standard Contractual Clauses for transfers of personal data outside the EU.
The CNIL had made public only one of these decisions in February 2022 in an anonymized way. In this decision, the CNIL considers that the use of the Google Analytics audience measurement solution is not GDPR compliant because personal data collected through the cookies of the solution are transferred to the United States without sufficient measures applied to prevent any possible access from the authorities to the personal data. Although efforts were made by Google to deploy additional measures in consideration of the Schrems II ruling, the CNIL considers that this is still not sufficient.
Read more at Engage.