Spanish authority for personal data protection recently passed a decision rejecting one of 101 appeals filed by NOYB, privacy activist organisation, against 101 European company for using Google Analytics.
Namely, this decision is the first one to reject one of the aforesaid appeals and, as such, it diverts from the position taken on this matter by competent authorities of French, Italy, Austria and Denmark.
Reasons for the decision
As already mentioned, the decision was passed upon a complaint lodged in relation to the use of Google Analytics, in this particular case against the Spanish Royal Academy (“RAE”), a public institution for protection of the Spanish language.
In response to the complaint, RAE underlined that the sole purpose of using Google Analytics in their case was to achieve one of the goals of this institution, i.e., preservation of the Spanish language, instead of gaining profit or achieving other interests of commercial nature. To that end, the respective service was used to collect aggregated statistical data, i.e., they did not have the access to individual IP addresses of users, but only to their ID numbers randomly allocated by Google, based on which it is impossible to re-identify the users. This practice of RAE lasted until December 3, 2020.
The acting authority accepted this argumentation and accordingly decided that there is no evidence that RAE acted against the GDPR provisions in this case.
Practical significance of the decision
According to this decision, any use of Google Analytics does not necessarily imply breach of the GDPR provisions. However, such position significantly diverts from the previous practice on this issue and one can say that this is currently an isolated case in positions of EU member states’ authorities in charge of personal data protection.
This article is to be considered as exclusively informative, with no intention to provide legal advice.
By Ivana Ruzicic, Managing Partner, and Lara Maksimovic, Senior Associate, PR Legal
