DP News – Week 10. NOYB files complaints against websites non addressing access requests, Norwegian Datatilsynet issues preliminary ruling in Google Analytics case.

One year after the EDPB issued Guidelines 01/2022 on data subject rights – Right of access (currently – version for public consultations), NOYB has filed several complaints against data brokers for failing to appropriately handle access requests that relied on cookies for authentication. More specifically, these companies were ignoring access requests or demanding extraneous information beyond what is necessary for authentication.

As NOYB’s official press-release explains, “users made a number of access requests based on cookie data in a noyb project. […] In order to obtain the information gathered on them, the users attached the cookies placed by the websites to their access request as a means of identification. However, many websites and the data brokers did not answer the access request sufficiently”.

As Stefano Rossetti, data protection lawyer at noyb, further points out, “The idea behind these complaints is simple: if a company can use a cookie to track, profile and send me targeted advertising, why should I not be able to use that very same cookie to exercise my GDPR right?”

***
On 01 March, the Norwegian Data Protection Authority ‘Datatilsynet’ issued a preliminary decision that the use of Google Analytics is not in line with the GDPR. The decision was adopted in the follow-up to a series of complaints submitted by NOYB against a series of website operators in the EEA, one of which was Telenor, a leading telecommunications company across the Nordics and Asia. Previously, data protection authorities in other EU countries (Austria, France, Italy, Denmark) took the stance that the usage of Google Analytics is not compliant with the GDPR and, specifically, international data transfer rules.

The decision is, however, preliminary, and the way towards a final one will be long. First, the parties (NOYB, Telenor) will be given three weeks to comment on the findings. Second, the draft decision will then be shared with other supervisory authorities concerned which have the right to raise relevant and reasoned objections, and only after that Datatilsynet will take a final decision, and this will not happen until the end of April at the earliest.

Interestingly, the starting point for the Datatilsynet’s assessment was Google Analytics 3 (GA3), and not Google Analytics 4. Datatilsynet explains that it “has not taken a position on this in the specific case, but as far as we can see, Google Analytics 4 will not necessarily correct those problems we have so far identified”. On that occasion, the Norwegian Datatilsynet refers to the conclusion of Danish Datatilsynet which believes Google Analytics 4 to be still problematic from the international data transfers perspective.