Hacker News Reader

Comment by V__ | Hacker News Reader

There are a lot of different viewpoints regarding GDPR. But the one thing which grinds my gears the most is the fact that somehow people using tools like Google Analytics take on legal risk, but not Google itself for providing it.

Google has offices in Europe. Why, if it isn't possible to use it in compliance with the law (as a customer), isn't Google forced to shut it down or change it?

The same goes for Facebook and all other companies offering tracking etc. They should be responsible for offering compliant products.

View on HN

If I was defending them, I'd use an argument along the lines of "trackers don't track people". In other words, "improper" use of the tools is the crime, not the creation of the tools themselves.

Is it actually possible to use it in a not improper way though? That's the issue I think, if Google are going to offer the tool for use in EU, then their tool should not put its customers at legal risk.

The thing about GDPR is, the intention (in most cases) doesn't matter. If Google is using servers outside Europe or using the data for anything not officially disclosed (and disclosures hidden in eulas etc. don't count) then they are in breach of GDPR.

Nah, I don't think so.

Google is a subcontractor. The owner of the website is using a service to track browser behaviour, and, perhaps erroneously, user identities. The service is famous, but not unique.

What the subcontractor does with the data is the responsibility of the website owner -- if they allow Google to abuse the data owner (that is, misuse the PII of people visiting the website), then the website owner should be held responsible.

> What the subcontractor does with the data is the responsibility of the website owner

That's my issue. Since Google has legal entities in Europe they should be held accountable as well. Right now they are offering and marketing a service which is more or less illegal to use. If it were some company outside Europe, then yes by all means the website owner should make sure the 'subcontractor' is in compliance.

> Google is a subcontractor.

Are they though, if Google is providing the analytics and the ads? Seems more like the content provider is the subcontractor.

I think you miss the point: Google are the data processor in this case. (In fact, as the body collecting the data, they also have shades of a data controller.) Doesn't matter if they're a subcontractor: they have responsibilities under the GDPR, because they're the ones holding onto that data. It's not like they're holding it in some form, passing it on to the website owner, and obliterating it.

I would recommend searching for the terms "data processor" and "data controller" on the European Commission website. They have very clear explanations of the responsibilities for both.

> Why, if it isn't possible to use it in compliance with the law

As far as I can see, the problem was the way a specific site was using analytics. I.e. it's possible to use anaytics in compliance with GDPR. Have I misread it?

[Edit] The website operator seems to have failed to scrub IP addresses from data uploaded to analytics. This stuff about "EU Users can't use US cloud services" seems overcooked.

You are right regarding the IP, the question would be however, why this isn't deactivated by default.

Regarding the cloud:

> In 2020, the EU Court of Justice struck down the so-called Privacy Shield data protection arrangements between the bloc and the US in what is now known as the Schrems II ruling, which has ramifications for US cloud providers, social media sites, and providers of online tools.

> "This is a very detailed and sound decision. The bottom line is: companies can't use US cloud services in Europe anymore. It has now been 1.5 years since the Court of Justice confirmed this a second time, so it is more than time that the law is also enforced.

That's some kind of summary (and it looks a bit partisan).

It's perfectly permissible to use "cloud" services that are in the USA. It's just forbidden to use cloud services in the USA to store PII.

enabling IP anonymization to my knowledge breaks geo-related features in GA.

Reply on news.ycombinator.com