By Anders Pilgaard Andersen, senior vice chairman, normal counsel, Adform 

Current selections by a number of EU knowledge safety authorities sign the usage of Google Analytics violates the EU Common Knowledge Safety Regulation (GDPR). These selections sound a warning not solely to the various firms utilizing Google Analytics however, extra broadly, to any firm utilizing US-based advert tech and mar tech platforms, since most firms gather and switch the identical sorts of protected knowledge.

If this appears like your organization, right here’s what it is best to know – and what try to be serious about as you think about tips on how to reply.

A flurry of GDPR rulings towards Google Analytics

The latest cascade of selections and statements ship a sign that European enforcement authorities could not tolerate US entry to knowledge of European residents.

In early January, the European Knowledge Safety Board (EDPB) publicly reprimanded the European Parliament for breaching the GDPR by its use of Google Analytics. Per week later, the Austrian Knowledge Safety Authority printed a choice stating the usage of Google Analytics violates the EU Common Knowledge Safety Regulation (GDPR).

The Austrian determination was quickly adopted by comparable selections or press statements by the Dutch, Danish and French knowledge safety authorities.

These selections typically state the prevailing setup – the place knowledge about European residents is collected, transferred to and saved within the US – is in breach of Article 44 of the GDPR. Extra particularly, authorities dominated the switch of private knowledge to the US did not be protected against the US authorities’s capability to look into the info beneath US surveillance legal guidelines.

Up to now, the EU and US managed to resolve such points by the now-invalidated Privateness Protect. However that perspective has clearly modified on account of so many comparable rulings over a brief time frame.

Furthermore, the speedy echoing of this position-change throughout Europe, in addition to a brief one-month compliance window in a French case, make it clear that authorities see this as an pressing problem and can count on firms to reply rapidly.

A turning level for advertisers utilizing US-based advert tech and mar tech

The rulings towards Google Analytics characterize a possible bombshell for the promoting trade, given the widespread use of US-based advert tech and mar tech platforms. Any such platform which, much like Google Analytics, processes cookie knowledge of European knowledge topics is probably going affected right here.

Additional, the French DPA stated this extends to “different instruments utilized by websites that outcome within the switch of information of European web customers to the US.” The Danish DPA famous that extra circumstances can be issued throughout the EU.

Advertisers and publishers have to act now

IAB Europe continues working to make the Transparency and Consent Framework (TCF) the primary GDPR-backed certification seal or code of conduct beneath Articles 41-42 of the GDPR for the advert tech trade. Such seal or code of conduct for the TCF as a framework would deliver readability to all stakeholders within the internet advertising trade, from advertisers and know-how suppliers to publishers and finish customers alike.

However can firms utilizing US-based advert tech and mar tech afford to attend for additional readability or steering from IAB Europe or from EU authorities? Or, at a minimal, what ought to advertisers and publishers do now?

Step one is to assemble main stakeholders from advertising and marketing, authorized and compliance, IT operations and IT safety to start answering the next questions:

• What knowledge do you gather? The place is it saved? Who can entry it? Guarantee a full understanding of your individual – and your distributors’ – stream of information.
• How do your contractual obligations impression your compliance necessities?
• How will you do extra from a technical and safety perspective – e.g., Can knowledge be anonymized earlier than shared?
• Primarily based on the above solutions, do you’re feeling assured you possibly can proceed working with US-based distributors, or do you have to think about options?

Extremely regulated industries with excessive consideration to compliance (e.g., monetary firms, telcos, and so forth.) are possible already within the technique of figuring out tips on how to reaccess their promoting distributors based mostly on these selections. However actually, any firm working in Europe who collects knowledge on its clients ought to instantly pause to start a reevaluation train, just like the one outlined above, to find out whether it is compliant with these new selections relating to providers from US-based platforms.