Swedish data protection watchdog has fined two companies for using Google Analytics for web statistics, asking them, along with two more companies it audited, to stop using Google Analytics.
The Swedish Authority for Privacy Protection (IMY) audited how four companies use Google Analytics for web statistics.
IMY issued administrative fines against two of the companies. One of the companies has recently stopped using the statistics tool on its own initiative, while IMY orders the other three to also stop using it.
Google Analytics is a tool for measuring and analysing traffic on websites.
The companies audited were CDON, Coop, Dagens Industri and Tele2.
IMY issued an administrative fine of 12 million SEK (over $1.1 million) against Tele2 and 300,000 SEK (around $30,000) against CDON.
“The audits are based on complaints from the organisation None of Your Business (NOYB) in the light of the Schrems II ruling by the European Court of Justice (CJEU). The complaints allege that the companies, in violation of the law, transfer personal data to the United States,” said the IMY in its ruling.
In its audits, IMY considered that the data transferred to the US via Google’s statistics tool is personal data because the data can be linked with other unique data that is transferred.
All four companies have based their decisions on the transfer of personal data via Google Analytics on standard contractual clauses.
“From IMY’s audits, it appears that none of the companies’ additional technical security measures are sufficient,” said the watchdog.
